Compliance Risk Management Applying The COSO ERM Framework

C o m m i t t e e o f S p o n s o r i n g O r g a n i z a t i o n s o f t h e T r e a d w a y C o m m i s s i o n
Ent er pr ise Risk Ma n a g e m e n t
COMPLIANCE RISK
MANAGEMENT:
APPLYING THE COSO
ERM FRAMEWORK
By
The information contained herein is of a general nature and based on authorities that are subject to change. Applicability of the information
to specific situations should be determined through consultation with your professional adviser, and this paper should not be considered
substitute for the services of such advisors, nor should it be used as a basis for any decision or action that may affect your organization.
Authors
Society of Corporate Compliance and Ethics & Health Care Compliance Association (SCCE & HCCA)
COSO Board Members

Paul J. Sobel
COSO Chair Daniel C. Murdock
Financial Executives International
Douglas F. Prawitt
American Accounting Association Jeffrey C. Thomson
Institute of Management Accountants
Robert D. Dohrer
American Institute of CPAs Patty K. Miller
(AICPA) The Institute of Internal Auditors
Preface
This project was commissioned by the Committee of Sponsoring Organizations of the Treadway Commission
(COSO), which is dedicated to providing thought leadership through the development of comprehensive
frameworks and guidance on enterprise risk management, internal control, and fraud deterrence designed to
improve organizational performance and governance and to reduce the extent of fraud in organizations.
COSO is a private-sector initiative jointly sponsored and funded by the following organizations:
American Accounting Association (AAA)
American Institute of CPAs (AICPA)
Financial Executives International (FEI)
The Institute of Management Accountants

(IMA) Committee of Sponsoring Organizations
of the Treadway Commission
c o s o . or g
The Institute of Internal Auditors (IIA)
Enterprise Risk Management | Compliance isk Management: Applying the COSO ERM Framework | i
R
Ent erprise Risk M a n a g e m e n t
COMPLIANCE RISK
MANAGEMENT:
APPLYING THE COSO ERM
FRAMEWORK
Research Commissioned by
Committee of Sponsoring Organizations of the Treadway Commission
November 2020
c oso . or
g
ii | Enterprise Risk Management | Compliance Risk Management: Applying the COSO ERM Framework
Copyright © 2020, Committee of Sponsoring Organizations of the Treadway Commission (COSO).

1234567890 PIP 198765432
COSO images are from COSO Enterprise Risk Management - Integrating with Strategy and Performance ©2017, The
American Institute of Certified Public Accountants on behalf of the Committee of Sponsoring Organizations of the
Treadway Commission (COSO). COSO is a trademark of the Committee of Sponsoring Organizations of the Treadway
Commission.
All Rights Reserved. No part of this publication may be reproduced, redistributed, transmitted, or displayed in any form or
by any means without written permission. For information regarding licensing and reprint permissions, please contact the
American Institute of Certified Public Accountants, which handles licensing and permissions for COSO copyrighted materials.
Direct all inquiries to [email protected] or AICPA, Attn: Manager, Licensing & Rights, 220 Leigh Farm
Road, Durham, NC 27707 USA. Telephone inquiries may be directed to 888-777-7077.
Design and production: Sergio Analco.

c o s o . or g
iv | Enterprise Risk Management | Compliance Risk Management: Applying the COSO ERM Framework
Contents Page
1. Introduction 1
2. Governance and Culture for Compliance Risks 7
3. Strategy and Objective-Setting for Compliance Risks 11
4. Performance for Compliance Risks 15
5. Review and Revision for Compliance Risks 22
6. Information, Communication, and Reporting

for Compliance Risks 27
Appendix 1.
Elements of an effective compliance
and ethics program 31
Appendix 2.
International growth in recognition
of compliance and ethics programs 37
Acknowledgments 39
About SCCE & HCCA 39
About COSO 40
Enterprise Risk Management | Compliance Risk Management: Applying the COSO ERM Framework | iii
c o s o . or
g
Enterprise Risk Management | Compliance Risk Management: Applying the COSO ERM Framework | 1
1. INTRODUCTION
some cases, the employee may also bear liability as an
Why this publication is needed individual.
Compliance risks are common and frequently material risks
to achieving an organization’s objectives. For many years,
compliance professionals have used a widely accepted
framework for compliance and ethics (C&E) programs to
prevent and timely detect noncompliance and other acts
of wrongdoing. The C&E program framework is described
in Appendix 1 (if readers are not already familiar with the
elements of a C&E program, consider reading Appendix 1
before proceeding). The COSO Enterprise Risk Management
(ERM) Framework, meanwhile, has been used by risk and
other professionals to identify and mitigate a variety of
organizational risks, including compliance risks.
This publication aims to provide guidance on the application

of the COSO ERM framework to the identification,
assessment, and management of compliance risks by
aligning it with the C&E program framework, creating a
powerful tool that integrates the concepts underlying each of
these valuable frameworks.
What are compliance and compliance-related

risks? Risk is defined by COSO as “the possibility that
events will occur and affect the achievement of strategy and
business objectives.” Risks considered in this definition
include those relating to all business objectives, including
compliance.
Compliance risks are those risks relating to possible
violations of applicable laws, regulations, contractual terms,
standards, or internal policies where such violation could
result in direct or indirect financial liability, civil or criminal
penalties, regulatory sanctions, or other negative effects for
the organization or its personnel. Throughout this
publication, “events” associated with compliance risks will
be referred to as “noncompliance” or “compliance
violations.”
Although the underlying acts (or failures to act) are carried

out by individuals, compliance violations are generally
attributable to the organization when they are carried out by
employees
or agents of the organization in the ordinary course of their
duties. The exact scope of acts attributable to an
organization can vary depending upon the circumstances. In
c o s o . or
g
2 | Enterprise Risk Management | Compliance Risk Management: Applying the COSO ERM Framework
Most compliance violations either inherently cause harm or

have the potential to result in direct harm to individuals,
communities, or organizations. Examples of parties that may be
harmed through compliance violations include customers (e.g.,
violations of privacy or data security laws leading to
a breach and theft of personal information, product safety
violations resulting in injuries, antitrust violations resulting in
inflated prices), employees (e.g., workplace safety regulation
violations resulting in injury to a worker, antidiscrimination or
whistleblower protection law violations), or the general public
(e.g., environmental violations resulting in illness or death).
Although most compliance risks relate to specific laws or

regulations, others do not. These other risks, referred to as
“compliance-related risks,” may include risks associated with
failures to comply with professional standards, internal policies of
an organization (including codes of conduct and business ethics),
and contractual obligations. For example, conflicts of interest
represent violations of laws or regulations only in limited instances
(frequently involving government officials or programs). Conflicts
of interest are frequently prohibited by professional standards,
terms of contracts and grant agreements, or internal policies, and
they are viewed
as damaging to an organization if they are not disclosed and
managed. As a result, conflicts of interest are commonly
included within the population of compliance risks.
Accordingly, throughout this publication, the term

“compliance risk” is used in reference to any risk that is
either directly associated with a law or regulation or is
compliance-related in that it is associated with other
standards, organizational policies, or ethical expectations and
guidelines.
As this discussion illustrates, the scope of what an organization

considers to be compliance risks is not an exact science,
although most organizations use a similar list of compliance risk
areas within the universe of their
programs (e.g., environmental, bribery, and corruption), even if the
specific compliance risks within each area may differ. Determining
the exact scope of a C&E program is typically
c o s o . or
g
both an early step in developing the program and an The current U.S. Federal Sentencing Guidelines (USSG)
ongoing exercise as the risk landscape changes, and input identify the following seven elements of an effective C&E
from compliance, legal, senior leaders, and the board are program:
considered.
1 Standards and procedures
Compliance violations often result in fines, penalties, civil
settlements, or similar financial liabilities. However, not all 2 Governance, oversight, and authority
compliance violations have direct financial ramifications. In
some cases, the initial impact may be purely reputational. 3 Due diligence in delegation of
However, reputational damage often leads to future financial
or nonfinancial harm, ranging from loss of customers to loss 4 authority Communication and training
of employees, competitive disadvantages, or other effects
5 Monitoring, auditing, and reporting systems
(e.g., suspension, debarment).
6 Incentives and enforcement
Most noncompliance stems from actions taken by insiders
– employees, management, or members of an 7 Response to wrongdoing
organization’s board of directors. Increasingly, risks also
result from contractors and other third parties whose Separately, the USSG also require that organizations
actions affect an organization. The most common examples periodically assess the risk of noncompliance and continually
involve vendors in an organization’s supply chain (e.g., look for ways to improve their C&E programs. This two-part
when a supplier of requirement has often been referred to as the eighth element
Egyptian cotton bedding for several major retailers was of an effective program. Each of these elements is explained
found to be using a lesser grade of cotton that was not from in greater detail in Appendix 1.
Egypt, the retailers incurred significant liabilities to their
customers) or third parties involved in the sales cycle (e.g., The USSG also state that organizations should promote a
intermediaries that may pay bribes to government officials in culture that encourages ethical conduct and a commitment
order to obtain lucrative contracts for an organization). to compliance with the law. This acknowledgment that
organizational culture and business ethics play integral roles
A final consideration in determining the scope of a in compliance risk management is one of the factors that led
program is the potential for inherited risks resulting from to the common use of the term “compliance and ethics
merger and acquisition (M&A) activity. As M&A program” or “C&E program”.
transactions take place, the universe of compliance risks
to which an organization is The USSG do not mandate C&E programs for any
exposed can change drastically and instantly. These risks organization; however, they provide an incentive for the
may relate to events that took place prior to the merger or establishment
may simply result from unique risks faced by the merged of such programs as a means of mitigating the significant
entity that the acquiror had not previously faced. penalties that can otherwise result when an organization is
found to have violated federal laws. In criminal cases
The evolution of compliance and ethics programs involving noncompliance with laws, an organization’s penalty
Although compliance with laws and regulations has been can be decreased significantly from a base amount
an expectation for many years, compliance and ethics as determined, in part, on the existence of an effective C&E
a profession and as a distinct function in organizations is program. Developing case law related to the guidelines has
a added further weight
relatively recent development. It stems from the equally to the importance of C&E programs, particularly in highly
recent emergence of the C&E program as a valuable and regulated entities, with courts concluding that the failure to
frequently required element of organizational management. implement an effective C&E program may represent a
breach of fiduciary duty. Additionally, guidance issued by the
A series of events in the 1980s in the United States led to U.S. Department of Justice and other agencies have
the U.S. Sentencing Commission publishing guidelines in emphasized the importance of C&E programs.
1991 for the punishment of organizations for violations of
the law. Among its provisions, the sentencing guidelines Although the USSG don’t require organizations to have C&E
for programs, individual government agencies sometimes do.
organizations provide for very significant reductions in For example, certain healthcare organizations must have
criminal penalties if an organization has an effective compliance programs as a condition for eligibility to participate
compliance program in place. Important amendments were in Medicare, and the Federal Acquisition Regulations require
made in 2004 and 2010 to clarify and expand on the certain government contractors to have compliance programs.
characteristics of an effective program.
c o s o . or
g
Finally, a compliance department should be separate from Anti- bribery management systems standard includes
the legal and regulatory affairs department. This the following expectations of a program:
independence
is not generally required, but is rapidly emerging as a
preferred practice due to the differing and sometimes
conflicting responsibilities of the two functions. For
example, guidance issued by the Office of Inspector
General of
the U.S. Department of Health and Human Services (HHS
OIG) indicates that the compliance department should be
independent. In its 2012 A Toolkit for Health Care Boards, the
HHS OIG’s Health Care Fraud Prevention and Enforcement
Action Team (HEAT) stated: “Protect the compliance
officer’s independence by separating this role from your
legal counsel and senior management. All decisions
affecting the compliance officer’s employment or limiting
the scope of the compliance program should require prior
board approval.”
International guidance on compliance and

ethics programs
Although the most extensive statutory, regulatory, and
nonregulatory guidance on C&E programs has emanated
from the United States, many other countries have issued
various forms of requirements for and guidance on C&E
programs. In some instances, guidance on C&E programs
outside the U.S. is limited in application to specific areas of
the law, such as bribery and corruption or
antitrust/competition. In others, it is broader, like it is in the
U.S., and applicable to many areas of the law. Much of the
guidance issued globally mirrors many of the concepts and
elements described in the USSG.
A sampling of some of the guidance from outside the U.S.

reveals a mostly consistent picture of what regulators
expect from C&E programs. For example, the United
Kingdom’s Ministry of Justice has provided guidance on the
Bribery Act 2010, describing procedures that commercial
organizations can put in place to minimize the risk of
bribery. Those procedures are summarized into the
following six principles, which that closely align with the
USSG:
1 Proportionate procedures
2 Top-level commitment
3 Risk assessment
4 Due diligence
5 Communication (including training)
6 Monitoring and review
Guidance has also been issued by the International

Organization for Standardization (ISO). Its 2016 ISO 37001
c o s o . or
g
Performance of a bribery risk assessment 1
Leadership and commitment to the anti-bribery 2
management system
Establishment of an anti-bribery compliance function 3
Sufficient resources provided for the anti-bribery management 4
system
Competence of employees 5
Awareness and training on anti-bribery policies 6
Due diligence in connection with third-party business associates 7
and employees
Establishment and implementation of anti-bribery controls 8
Internal audit of the anti-bribery management system 9
Periodic reviews of the anti-bribery management system by 10
the governing body
Beyond bribery, ISO has also issued guidance more broadly on

compliance management systems in the form of ISO
19600:2014. Most recently, ISO/DIS 37301 was proposed in 2020 to
replace ISO 19600. The draft new standard describes the
following five elements of a compliance management system:
Compliance obligations (identification of new and changed 1
compliance requirements)
Compliance risk assessment 2
Compliance policy 3
Training and communication 4
Performance evaluation 5
A variety of other legal and regulatory developments that do

not directly reference C&E programs nonetheless affect them.
For example, 2019 European Union regulations aimed at
providing new protections for whistleblowers help in
supporting an important element of an effective C&E program.
Similarly, data protection and privacy laws commonly differ from
one country to another, but frequently have direct or indirect
effects on C&E programs.
Additional examples of international guidance on C&E programs

are provided in Appendix 2. What it shows is that global
guidance on C&E programs has far more similarities than
c o s o . or
g
differences, even if the scope of application of a C&E

program may differ (i.e., limited to bribery and corruption Figure 1.1 The COSO 2013 Framework
in some jurisdictions and broader application in others). The
common thread across these various guides is a shared
appreciation for the elements on which this COSO guide is
based.
The relationship between compliance,

internal control, and enterprise risk
management
COSO defines internal control in Internal Control –
Integrated Framework (2013) and Enterprise Risk
Management – Integrating with Strategy and Performance
(2017) as follows:
A process, effected by an entity’s board of directors,

management, and other personnel, designed Source: COSO Internal Control Framework ©2013
to provide reasonable assurance regarding the
achievement of objectives relating COSO defines ERM as follows:
to operations, reporting, and compliance.
The culture, capabilities, and practices, integrated
As this definition clearly points out, internal control is not with strategy-setting and its performance, that
solely about accounting and financial matters. Compliance organizations rely on to manage risk in creating,
with laws and regulations is one of the three fundamental preserving, and realizing value.
objectives of an organization’s system of internal controls.
The COSO ERM framework, like the internal control
The following five components of internal control support
framework, comprises five interrelated
all three categories of objectives:
components:
• Control environment
Governance & culture
• Risk assessment
Strategy & objective-setting
• Control activities
Performance
• Information and communication
Review and revision
• Monitoring activities
Information, communication, and reporting
The relationships between the three objectives, five
components, and the entity are depicted in figure
1.1:
Figure 1.2 Risk Management Components
MISSION, VISION STRATEGY BUSINESS IMPLEMENTATION ENHANCED

& CORE VALUES DEVELOPMENT OBJECTIVE & PERFORMANCE VALUE
FORMULATION
Governance Strategy & Performance Review Information,

& Culture Objective-Setting & Revision Communication, &
Reporting
Source: COSO Enterprise Risk Management—Integrating with Strategy and Performance
c o s o . or
g
ERM is different than, but related to, internal controls. ERM There is not a universally accepted definition for the
incorporates some of the concepts of internal control. In scope of an organization’s C&E program. It can vary from
fact, implementation of internal controls is the most one organization to another. As a result, compliance with
common approach to reducing risk. But ERM also includes some laws and regulations may be primarily subject to
certain concepts that are not considered within internal the
control. For example, concepts of risk appetite, tolerance, oversight of others, although the compliance function should
strategy, and business objectives are set within ERM, but always be prepared to serve an overarching role or to step
are viewed as in to assist or address issues if the others are unable or
preconditions of internal control. ERM is more closely aligned unwilling to properly manage the risk.
with strategy than internal control.
Another difference among organizations may involve where
An important aspect of ERM is its focus on creating, the compliance function “sits” within the organization.
preserving, and realizing value. The C&E program supports Although a C&E program is organization-wide, involving
each of these three goals. An effective C&E program employees and managers from all functional areas, the
allows an organization to more confidently pursue new compliance function, consisting of a dedicated team of
value creation opportunities. Further, value that has been compliance and ethics professionals, may be positioned in
created by an organization can quickly become impaired a variety of locations within an organization chart. In most
when accompanied by violations of laws or regulations. An organizations, it is an independent function, and this is
effective C&E program can preserve this value and enable an considered the best practice. In others, it may be a part of,
organization to fully realize it. or report to, legal, internal audit, risk management, or
another function. Regardless of where the compliance
Accordingly, the management of compliance risk is an function is positioned on an organization chart,
important element of both the internal control and the communication and collaboration with each of the preceding
broader ERM functions and processes of an organization. functions are essential to the success of a C&E program.
The scope and positioning of the compliance Likewise, ethics may be considered a function apart from
function in an organization compliance. In many organizations, however, compliance
As noted earlier, compliance risk generally involves the risk and ethics fall under a compliance and ethics officer.
of violations of laws and regulations, but it may also address
contract provisions, professional standards, organizational It is important to understand that although virtually every
policy, and ethics matters. The laws and regulations that employee plays a role in managing risk, the management/
fall within the scope of a compliance program, however, mitigation of compliance risk is primarily the responsibility of
can vary by industry and from organization to organization. all management at all levels. The compliance function leads
For example, risk of violating the Foreign Corrupt Practices the development of the C&E program, but it is ultimately
Act may fall clearly within the scope of a company’s C&E management’s job to execute the program and for the board
program. But compliance with accounting standards to provide oversight. The role of the compliance and ethics
required in filings with the U.S. Securities and Exchange officer is to help management understand the risks; lead the
Commission may be addressed within the accounting and development of the program to mitigate and manage those
finance functions and may be considered outside the scope risks; evaluate how well the program is being executed;
of the C&E program. Human resources and employment and report to leadership on gaps in coverage, execution,
law risks may be managed entirely within the human or material instances of noncompliance, including those by
resources function, or the compliance function may also senior leaders.
participate in managing these risks.
In summary, management of compliance risk can be
performed effectively under a variety of structural models.
This publication provides guidance on the design and
operation of an effective C&E program regardless of the
organizational structure or how responsibilities are allocated.
c o s o . or
g
About this Guidance

When the USSG were developed, and as the elements of
There are several target audiences for this publication,
effective C&E programs have evolved, fitting the seven
including the following:
elements within the ERM framework was not a significant
1 Professionals such as risk managers, internal concern or objective. Indeed, much of this evolution
auditors, and others who are involved in applying an occurred before the first ERM framework was published by
organization’s ERM program to compliance risks. COSO in 2004.
2 Compliance professionals who are aiming to align In the remaining portions of this guide, each of the 20
their C&E program to, or integrate it with, principles of the COSO ERM framework, depicted in figure
an organization-wide ERM program. 1.3, is mapped to the specific requirements and emerging
practices of an effective C&E program. Section 2 starts with
3 The senior management team, to better the governance and culture component and the related
understand compliance risk and the C&E five principles. Sections 3 to 6 cover the other components
program. and their related principles, respectively. In each, key steps
are provided to implement and maintain an effective C&E
4 Members of the board of directors, to assist them
program for each of the ERM principles.
in their oversight role.
Figure 1.3 Risk Management Components - The 20 principles

Governance Strategy & Performance Review Information,
& Culture Objective-Setting & Revision Communication,
& Reporting
1. Exercises Board Risk 6. Analyzes Business 10. Identifies Risk 15. Assesses Substantial 18. Leverages Information
Oversight Context Change and Technology
11. Assesses Severity of
2. Establishes Operating 7. Defines Risk Appetite Risk 16. Reviews Risk and 19. Communicates Risk
Structures 8. Evaluates Alternative Performance Information
12. Prioritizes Risks
3. Defines Desired Culture Strategies 17. Pursues improvement in 20. Reports on Risk,
13. Implements Risk
4. Demonstrates 9. Formulates Business Responses Enterprise Risk Culture, and
Commitment to Objectives Management Performance
14. Develops Portfolio
Core Values
View
5. Attracts, Develops, and
Retains Capable
Individuals
Source: COSO Enterprise Risk Management—Integrating with Strategy and Performance
An example of the application of the guidance provided in this publication to a specific compliance risk can be found at
corporatecompliance.org/coso.
Figure 1.4 Frequently used terms and abbreviations

The following terms and abbreviations are used frequently throughout this publication
Board The board of directors or, where appropriate, a board-level committee that has been delegated the responsibility
for compliance oversight by the board of directors
C&E program Compliance and ethics program
CCO The chief compliance officer, chief compliance and ethics officer, or the equivalent title associated with the
highest-ranking employee charged with oversight of the C&E program
Compliance An internal committee composed of employees from various departments and functions within an
committee organization whose mission is to advise, inform, and partner with the CCO in communicating and extending the
compliance function throughout the organization’s operations
Compliance The possibility that violations of applicable laws, regulations, contractual terms, standards, or internal policies
risk will occur and have a negative financial or nonfinancial impact on the organization
DOJ The United States Department of Justice
USSG The United States Federal Sentencing Guidelines
c o s o . or
g
2. GOVERNANCE AND CULTURE

FOR COMPLIANCE RISKS
This section describes the application of the governance — time that may be unavailable for the entire board. As
and culture component of the COSO ERM framework to noted earlier, the term “board” is used in reference to either
the management of compliance risks. The COSO the board of directors or a board-level committee that has
framework describes the following five principles that oversight responsibility for the C&E program.
underlie this component:
For oversight to be exercised properly, there must be an
1 Exercises board risk oversight open and direct line of communication between the CCO
2 Establishes operating structures and the board. This communication should include regularly
scheduled, periodic meetings, including sessions in which
3 Defines desired culture the board meets privately with the CCO without other
members of senior management present.
4 Demonstrates commitment to core values
5 Attracts, develops, and retains capable individuals Having compliance expertise on the board can be extremely
valuable and can enhance oversight of the program. Ideally,
Principle 1 – Exercises board risk oversight this expertise comes from industry-specific experience with
The board of directors is responsible for oversight of the relevant compliance issues as well as experience developing
organization’s C&E program, and management is responsible and managing effective compliance programs.
for the design and operation of the program. The expectation
of board oversight is reinforced in C&E program standards The board should also ensure there is an effective
that have been promulgated in several countries. For compliance oversight infrastructure in place to support the
instance, the USSG § 8B2.1(b)(2)(A)-(C) state that a company’s C&E program, to include adequate staffing and resources,
“governing authority shall be knowledgeable about the as well as appropriate authority and empowerment to
content and operation of the compliance and ethics program achieve the objectives of the program. This infrastructure
and shall exercise reasonable oversight.” may also include an internal compliance committee. Often,
an internal compliance committee composed of individuals
Given the possible complexity of an organization’s C&E from key functions or business units is an effective way
program, it is often advisable for the board to delegate for the CCO to maintain open lines of communication to
responsibility for this oversight to a board-level standing facilitate timely awareness of emerging compliance risk
committee, much like audit oversight is commonly delegated areas and to obtain important input and buy-in on how to
to an audit committee. mitigate and address risks.
This enables a committee to devote sufficient time to
oversight
Table 2.1 Exercises board risk oversight

Key • Require the board to oversee compliance risk management and the C&E program, including the approval of its
characteristics charter
• Ensure that the board is knowledgeable of and demonstrates oversight of the C&E program (regular part of
agendas, monitors compliance metrics, holds regular executive sessions with CCO and others)
• Require that the board includes a member who possesses compliance expertise
• Document evidence of board oversight of the C&E program in minutes
• Provide input or approve appointment/dismissal/reassignment of CCO and ensure independence
• Ensure that sufficient resources are provided for the C&E program
• Receive regular reports from the CCO
c o s o . or
g
• Ensure that the board is informed about material investigations and remediation efforts and provides input
c o s o . or
g
Principle 2 — Establishes operating structures

level compliance committee, the committee should operate
The positioning of the compliance function within an
in accordance with a board-approved charter. The charter
organization has important implications for the effectiveness
describes in detail the responsibilities and key operating
of the program. The compliance function should be led by
procedures of the committee (e.g., frequency and nature of
someone who is positioned to be effective, which typically
meetings, reporting to the board) as well as the
means being a peer of other senior leaders. Moreover, the
compliance function must have the practical authority, qualifications for committee members.
resources, and tools to effectively fulfill its mandate. Finally,
Increasingly, regulators and the enforcement community
the compliance function should be functionally separate
and distinct from other functions, particularly those that are consider the stature of the compliance function relative to
frequently perceived by regulators as having conflicting other executive functions as a signal of how seriously the
obligations or priorities (e.g., legal, finance, etc.). Although C&E program, and therefore compliance with laws and
it may be possible for the compliance and ethics function regulations, is viewed within an organization. Is the
to be effective when housed within other departments, compliance function buried several layers down the
the preferred practice is for compliance to be functionally organization chart? Or is
separate and — like internal audit — report to the board. If it represented at a very high executive level? Stature
the function does not report to the board, extra care must be also considers positioning of the CCO relative to other
taken to ensure adequate resources and sufficient autonomy, senior executives of an organization.
including direct and unfiltered access to the board.
Operating structure should also include other key compliance
policies and procedures, such as those that govern
Operating structure should also include documented policies
the methodology and performance of compliance risk
and procedures covering the governance and decision-
assessments, consideration of forming an internal
making processes associated with the C&E program. From
compliance committee with representation from across the
a governance standpoint, if oversight of the C&E program
organization, and procedures for escalation when significant
has been delegated by the board of directors to a board-
risk events occur, among other procedures.
Table 2.2 Establishes operating structures

Key • Maintain independence of the CCO and the compliance and ethics function
characteristics • Ensure that the CCO directly reports to and regularly communicates with the board
• Ensure that the CCO and C&E program have high stature relative to other functional leaders
• Grant sufficient authority to the CCO to manage the program effectively
• Provide sufficient resources for the C&E program to be effective
• Address C&E program oversight in the charter (including delegation to a designated committee, if applicable)
• Document policies and procedures specific to the operation of the C&E program
• Establish protocol/procedures for escalation of significant compliance risk events
Principle 3 — Defines desired culture

An exercise that is helpful in setting expectations for culture
It is critical for the organization to establish and maintain a
is for senior management to have a robust discussion about
culture of compliance and integrity. Without it, even the
the relationship between compliance risk and the
most carefully designed compliance controls will be
organization’s risk appetite and risk tolerance, which are
vulnerable
discussed further in the next section. In particular, tolerance,
to failure. Culture begins with a sincere commitment
which considers acceptable levels of variation in performance
to compliance and ethics at the leadership level. The
related to achieving business objectives, should consider the
commitment is reflected in several ways, beginning with its
potential impact of compliance risk, because compliance with
inclusion in a code of conduct or business ethics that is
laws, regulations, and other requirements should itself be
written in a manner that clearly articulates expectations of
one of the primary business objectives for all organizations.
behavior. Leadership can also reinforce and clarify this
culture through other communications. This commitment to
Another aspect in a culture of compliance is that of risk
culture should be further reflected through the adoption of
awareness. It is one thing to have a culture in which
important compliance metrics and by meaningfully
compliance is important. But an essential element of such an
incorporating compliance into
environment is a culture of risk awareness, where employees
the performance evaluation and compensation/incentive
are vigilant and willing to raise concerns when they see
compensation processes, particularly at leadership levels.
warning signs of risk.
c o s o . or
g
Communication and training are also important tools for training should include periodic discussion of the code
promoting an ethical culture, because each reinforces of conduct, but it should also include training on
an overall mindset of compliance and integrity, while specific
also compliance issues tailored to individual groups of employees
improving awareness of key compliance issues. exposed to these risks in connection with their work.
Accordingly,
Table 2.3 Defines desired culture

Key • Ensure that the board is knowledgeable of and approves a code of conduct/ethics and other
characteristics key compliance policies
• Explain expectations relating to ethics and compliance in a code of conduct/ethics
• Provide and require training on the code of conduct and on ethical decision-making for all staff (including
board members)
• Perform ongoing monitoring or assessment of organizational culture
• Develop objectively measurable compliance metrics tied to performance evaluations and compensation,
where appropriate
• Adopt meaningful incentives to promote consistent execution of the C&E program
• Include references to organizational values, expectations, and importance of ethics in communications from
leadership
Principle 4 — Demonstrates commitment to

accountable for their individual roles in managing compliance
core values
risks, and this should be reflected in job descriptions,
Commitment to core values should be represented in a value
performance evaluations, and incentives.
statement or other set of guiding principles that
demonstrates a commitment to compliance and ethical
When allegations of noncompliance or unethical behavior
business conduct. Increasingly, studies show a correlation
emerge, they must be taken seriously. This means that
between ethical culture and organizational performance,
individuals should be required to report wrongdoing and
consistent with ERM’s goal of creating value.
have multiple avenues for reporting. Once an allegation is
The tone from the top plays an important role in managing received, sound investigative protocols should be followed in
compliance risks. The tone set by the executive team must a timely manner to assess the credibility of the allegation. In
set an example of compliance and ethical behavior. This addition, individuals who report concerns about wrongdoing
commitment must cascade throughout the organization, must feel safe speaking up and be protected from retaliation
thus the term tone “from” the top rather than tone “at” the in order for this system to operate effectively.
top.
If wrongdoing is confirmed through the investigative
Each layer of leaders within an organization — the
process, disciplinary action should be taken in a degree that
supervisors and managers of others — must communicate
is appropriate to the level of wrongdoing. Discipline should
and pass this tone on to the next level.
be consistent based on the nature of the wrongdoing,
Commitment to compliance and ethics, however, requires without regard to the individual’s level on the organization
much more than setting the tone. Employees should be chart or level of influence within the organization.
held
Table 2.4 Demonstrates a commitment to core values

Key • Actively promote a culture of compliance risk awareness, including setting an ethical and compliant tone by
characteristics leadership
• Balance business incentives with material compliance incentives
• Incorporate accountability for the management of (1) compliance risks and (2) compliance program imple-
mentation into employee performance measurement, promotions, and incentive programs, particularly at
senior levels
• Protect those who report suspected wrongdoing, with zero tolerance for retaliation
• Take allegations of wrongdoing seriously and investigate in a timely manner
• Promote organizational justice, including accountability for wrongdoing, fairness and consistency in discipline,
and fairness in promotions
• Communicate lessons learned from compliance and ethics failures across the organization in
appropriate detail
c o s o . or
g
Principle 5 — Attracts, develops, and

individuals. These tools are critical for the management of
retains capable individuals
compliance risks as well. The Department of Justice (DOJ)
An effective compliance function should be led by a CCO
notes that a “hallmark of effective implementation of a
with appropriate experience and qualifications. The specifics
compliance program is the establishment of incentives for
of prior experience and other qualifications can vary based
compliance and disincentives for non-compliance.”
on the nature of the organization, its industry, and many
other factors.
Just as training on a code of conduct and broad ethical
issues helps to define an organization’s desired culture
Throughout the entire organization, hiring individuals who
(Principle 3), training on specific compliance risk topics
respect compliance and make business decisions in an
further develops individuals’ abilities to effectively recognize
ethical manner is vital to the management of compliance
and manage compliance risks. Furthermore, the compliance
risks. Indeed, being perceived as an organization that is
team itself should continue to be developed with training on
committed to compliance and ethics helps companies attract
emerging practices for managing a C&E program and
and retain good people.
changes in the legal/regulatory environment.
The USSG, which established the framework for what has
In recent years, numerous compliance issues have been
become the global standard for C&E programs, state that
triggered by third parties (nonemployees), especially those
an “organization shall use reasonable efforts not to include
within the substantial authority personnel of the organization that play integral roles in connection with supply chains,
sales, delivery, and other key functions. Accordingly, the due
any individual whom the organization knew, or should
diligence concepts described in this section should also be
have known through the exercise of due diligence, has
applied when engaging third parties to carry out activities
engaged in illegal activities or other conduct inconsistent
on behalf of the organization (e.g., suppliers, sales agents,
with an effective compliance and ethics program.” As such,
outsourcing partners), based on the level of compliance risk
organizations should perform background checks
associated with each third party. The degree of background
appropriate to the responsibilities of the position and in
checking, other due diligence, and compliance-related
compliance with relevant employment laws. The CCO may
performance measures should vary based on the assessed
collaborate with human resources and others to identify
level of risk, and due diligence should be repeated periodically
positions considered to involve “substantial authority”—
as part of maintaining ongoing relationships with high-risk
those that could create compliance risk for the organization.
third parties. Due diligence in engaging with certain third
The COSO ERM framework indicates that performance parties,
as well as ongoing training and monitoring of compliance
evaluation and the establishment of appropriate incentives
performance of third parties, have become expected by
are two important ingredients for developing and retaining
regulators and are integral elements of this principle.
Table 2.5 Attracts, develops, and retains capable individuals

Key • Hire and retain a CCO with appropriate experience/expertise to lead the C&E program
characteristics • Staff the compliance team with individuals that possess relevant expertise
• Perform background checks aimed at screening for compliance risk, tailored to the level of risk associated
with each position
• Consider employee execution of and adherence to the requirements and expectations of the C&E program in
the preparation of performance evaluations
• Appropriately tailor compliance training based on the compliance risks encountered for specific roles in
the organization
• Perform risk-based due diligence on third parties
c o s o . or
g
3. STRATEGY AND OBJECTIVE-SETTING

This section describes the application of the strategy and factors that can create new risks or change existing ones.
objective-setting component of the COSO ERM framework, Some of the most important internal drivers of compliance
and the following four principles associated with the risk include changes in people, processes, and technology.
management of compliance risks: Another driver of compliance risk is management pressure,
particularly when such pressure is not coupled with reminders
6 Analyzes business context regarding the expectation of compliance and appropriate
7 Defines risk appetite incentives to adhere to the C&E program. More broadly,
changes in organizational culture can arise from many factors
8 Evaluates alternative strategies and can affect compliance risk.
9 Formulates business objectives
External drivers of compliance risk also represent an
Principle 6 — Analyzes business context important element of context in identifying and managing
Context is critical to understanding and managing compliance risks. The most obvious external factors are those
compliance risks. Business decision-making is one of the involving the legal, regulatory, and enforcement landscape.
drivers of compliance risk; decisions can create new For example, recent changes in data privacy and security
risks, change existing risks, or eliminate risks. laws have created entirely new compliance risks for some
Accordingly, the organizations. External drivers also include competitive,
identification of a compliance risk universe should economic, and other factors that may directly or indirectly
consider the organization’s evolving strategy. The CCO affect compliance risk.
should have an appropriate level of involvement in the External factors may be at a macro level (e.g.,
strategy-setting process to enable the compliance industrywide competition, economic conditions) or at a
function to be positioned micro level (e.g., changes in local or regional laws and
to identify and develop plans to manage compliance risks regulations).
that emerge from changes in strategy. Likewise, the CCO
should be informed of sudden shifts in strategy that may Risk interdependencies may also affect how an organization
occur as an organization responds to changes in its manages compliance risks. An organization’s responses to
environment. other risks (e.g., strategic, financial) may affect compliance
risk in a positive or adverse way.
Context for effective compliance risk management
includes consideration of other internal drivers of
compliance risk —
Table 3.1 Analyzes business context

Key • Consider and reflect organizational strategy in performing compliance risk assessments and managing
characteristics compliance risk
• Consider how compliance risks are affected by internal changes, such as changes in people, structures,
processes, technology, etc.
• Evaluate effects of external factors (e.g., competitive, economic, enforcement trends, environmental, political,
social forces) on compliance risks
• Identify and consider risk interdependencies in the development of strategy
• Give consideration to cultural and regional differences in legal frameworks based on locations where the
organization operates
c o s o . or
g
Principle 7 — Defines risk appetite

request for a bribe from a building inspector. Examining
For those not familiar with the term, appetite for compliance
risk appetite with consideration for the full range of
risk often conjures up images of organizations willfully
potential consequences is an important element of
accepting known compliance violations. The very nature of
compliance risk management.
compliance risk means that a law may be violated that could
result in financial As noted in COSO’s May 2020 publication, Risk Appetite –
or nonfinancial consequences for the organization (e.g., fines,
Critical to Success: Using Risk Appetite to Thrive in a
suspension or debarment, reputational damage). The level of
Changing World, three of the inputs to risk appetite are as
acceptance of compliance risk in the pursuit of business
follows:
goals and objectives is a topic for discussion among
management and the board (being clear to point out that this
1.Board and management perspectives on appetite
discussion is not related to accepting known violations; it is
about the realistic assumption that it is impossible to
2.Understanding the existing risk profile
eliminate the possibility of a noncompliance event).
3.Organizational culture
As defined by COSO, risk appetite refers to the types and
amount of risk, on a broad level, that the organization is
Board and management perspective on risk appetite should
willing to accept in pursuit of value. Neither appetite nor
be framed, in part, on a consideration of the relationships
risk
between compliance risk and the achievement of business
tolerance — the acceptable levels of variation in
objectives. This can be achieved only if the board and
performance related to business objectives — is typically
management have a sufficient understanding of compliance
defined at the risk-specific level.
risk as a component of the organization’s overall risk profile.
Similarly, as noted earlier, maintaining a culture of
Although neither appetite nor tolerance are expressed in
compliance is an essential element of a C&E program and,
terms of compliance risk, there may be separate risk-centric
therefore, should be considered in developing an
statements relating to individual compliance risk areas. More
organization-wide appetite for risk in general.
commonly, the potential impact of compliance risk on the
achievement of business objectives should be considered in
Understanding how much of a threat a compliance risk
relation to determining and stating risk appetite and
poses to the achievement of business objectives enables
tolerance.
the CCO to effectively prioritize the deployment of
As noted earlier, compliance with laws, regulations, and
preventive and detective resources. For example, if an
other requirements should itself be considered as a business
organization has
objective of the organization.
determined that a particular category of compliance risk
poses a significant threat to the achievement of business
A practical way of viewing compliance risk and its relationship
objectives, the organization may allocate greater resources to
to risk appetite and tolerance is by viewing it at the business
managing that risk. More attention may be devoted to
unit or location level and by type of compliance risk. At the
auditing and monitoring in this area, among other possible
business unit (or functional) level, each group often has its
responses.
own unique compliance risks, each with vastly different
potential consequences for violations. For example, an
Organizations must also recognize that they cannot
international bribery violation may result in much more
realistically eliminate all compliance risks or reduce the
significant financial penalties than a building code violation.
likelihood of occurrence to zero. This is simply not possible.
As a result, engaging in discussions about risk appetite
Although a fire code violation may trigger only a rather
relating to compliance risks is a valuable tool in prioritizing
small fine, however, the potential consequences of a fire
efforts aimed at prevention and detection of specific
code violation tragically resulting in the loss of life could
compliance violations. Guidance from regulators is consistent
be enormous. Seemingly immaterial compliance risks like
with this concept: expecting organizations to reduce and
this building code violation could lead to other risks, such
manage, not necessarily eliminate, compliance risk.
as a
Table 3.2 Defines risk appetite
c o s o . or
g
Key • Consider compliance risk as part of the organization’s risk profile in determining risk appetite
characteristics • Consider compliance risk by (1) type of risk (e.g., anti-bribery), (2) business unit or organizational function
(e.g., human resources), and (3) location or region
• Determine and evaluate the relationships between compliance risks and the achievement of business
objectives
• Discuss risk appetite on a regular basis and update as necessary based on changes in compliance risk
• Consider developing specific risk-centric appetite statements associated with compliance risks in support
of organizational risk appetite and tolerance
c o s o . or
g
Principle 8 — Evaluates alternative strategies

mergers and acquisitions in order to understand the level of
The compliance function should be involved in strategy
risk that may be inherited as a result of the transaction, as
discussions from the standpoint of (1) understanding the
well as any C&E program integration needs and risks that
strategy so that the C&E program can be designed to
may need to be addressed.
manage compliance risks appropriately and (2) advising
strategic decision makers about possible compliance risks
Once strategy has been decided, the compliance function
associated with strategies under consideration.
should identify and understand the implications for
Compliance risk assessment and management are most
the organization’s C&E program. Begin by identifying
effective when the compliance function is fully informed
and assessing compliance risks, as well as suggesting
prior to embarking on new strategic initiatives, enabling
modifications to internal controls aimed at mitigating
the C&E program to be
compliance risk. Consider changes to training, monitoring, and
prepared to proactively address new or changing compliance
auditing plans for the C&E program, and the development of
risks. The CCO should also play a role in developing new
key compliance metrics or performance indicators.
compliance risk mitigation approaches in the context of
changing strategies and risk appetite, as well as assistance
As a strategy is being implemented, the organization may
in evaluating compliance risk issues associated with
continue to make changes to the strategy based on an
alternative strategies under consideration.
assessment of its successes and failures. This assessment
is another opportunity for the CCO to provide valuable
If strategic decisions made by an organization involve
input
merger or acquisition activities, it is important for
based on the C&E program’s monitoring and auditing
compliance to be involved early in the process so that
activities, which may have revealed a level of compliance risk
appropriate due diligence focusing on compliance risks can
that differs from what was initially expected.
be performed. This due diligence is important to the
decision-making process for
Table 3.3 Evaluates alternative strategies

Key • Ensure that the CCO has a seat at the table in discussions of strategies
characteristics • Solicit input and insight from the CCO regarding how strategy affects compliance risk
• Perform risk-based due diligence on merger and acquisition targets prior to execution of the transaction
• Consider implications of strategic decisions (including subsequent changes in strategy) in the design of the
C&E program
c o s o . or c oso . or
g g
Principle 9 — Formulates business objectives

objectives, but at a minimum, it is well informed of such
Linked to strategy, business objectives are measurable
objectives and the performance metrics that are used for
criteria by which the organization and individual business
individual evaluations.
units can
be evaluated. Much like how adoption of strategy can affect
Risk interactions should also be considered. As business
compliance risk, development of business objectives also
objectives and performance metrics change in one area of
often creates or affects the likelihood of compliance
the organization, compliance risks may be affected — either
violations. Additionally, complying with applicable laws,
in the same business unit or in other areas of the
regulations, contract terms, and other requirements should
organization.
be considered as its own business objective if compliance is
not explicitly addressed through other stated business
Finally, just as performance metrics are an essential
objectives.
characteristic for business units, the compliance function
itself should develop and monitor performance metrics.
Sometimes, performance metrics developed for business
These metrics address and measure how well the C&E
units can inadvertently create incentives to violate
program and infrastructure is working in practice across the
compliance requirements. Take the simple example of a
organization, and its overall effectiveness. Examples of
manufacturing facility whose personnel are incentivized by
measurable metrics
aggressive
— and key performance indicators (KPIs) — include such
new goals for increased production. This goal could lead
things as training completion rates, timeliness of
to shortcuts in quality control and inspections, resulting
responding to issues, investigations, and implementing
in
corrective action
product safety violations if the production team views
plans, volume, frequency, and types of issues reported
violating these compliance requirements as an acceptable
through the organizations’ reporting mechanisms, culture
means of achieving the new targets. The compliance function
survey responses over time, and metrics from monitoring
should be consulted as part of the establishment of business
various internal compliance controls such as vendor
objectives, in much the same manner as described in
payments in
Principle 8, to ensure that incentives are appropriately
high-risk operating locations. Although not all areas of the
structured to minimize the promotion of bad behavior or that
C&E program are easy to objectively measure, the
such incentives are balanced with appropriate compliance
compliance function should take steps to develop and
incentives. Ideally, compliance participates in the
monitor objective metrics wherever possible.
establishment of business
Table 3.4 Formulates business objectives

Key • Identify and evaluate compliance risks associated with planned business objectives
characteristics • Consider establishing compliance as a separate business objective
• Incorporate compliance risk management and accountability into performance measures and related
evaluations
• Consider interactions between compliance and other risks based on changes in business objectives
• Include objectively measured compliance metrics within business objectives, reflecting the management of
compliance risk and the effectiveness of C&E program implementation, and carrying appropriate weight in
incentive and other compensation decisions
c o s o . or
g
Enterprise Risk Management | Compliance Risk Management: Applying the COSO ERM Framework |
4. PERFORMANCE FOR
COMPLIANCE RISKS
This section describes the application of the performance would be responsible for most, if not all, aspects of
component of the COSO ERM framework and the following compliance with those laws. As compliance programs have
five principles associated with the management of matured, they have moved to a more integrative, proactive
compliance risks: approach based not on a particular past crisis that the
organization wishes to avoid repeating, but on the systematic
10 Identifies risk assessment of the organization and its environment to
11 Assesses severity of risk identify current and future threats to compliance. This same
motive is what drives organizations to implement ERM.
12 Prioritizes risk
13 Implements risk responses Not all compliance threats will be considered priorities in
the ERM context. For example, of the 10 most significant
14 Develops portfolio view compliance risks identified by the C&E program, perhaps
only 2 or 3 of them will be among the 10 most important
For C&E programs to be effective, it is expected by identified by the ERM function at the organizational level,
regulators and others that organizations periodically after consolidating compliance risks with all other risks.
assess the potential threats of legal, regulatory, and policy Yet for the C&E program, these are important, because
noncompliance, as well as ethical misconduct, so that they can emerge as serious threats through their impact
the organization can take steps to manage these risks to on the compliance culture. Regulators expect a specific
acceptable levels. assessment of compliance risks as part of the C&E program.
This suggests that even when an organization has a mature,
Principle 10 — Identifies risk well-developed ERM program, the C&E program should
One of the most challenging tasks for the C&E program is supplement the organizational-level ERM and should strive
the identification of the myriad compliance risks faced by to identify and manage all compliance risks, regardless of
the organization. Organizations are subject to thousands of whether all are material at the enterprise level.
laws and regulations ranging from antitrust, privacy, fraud,
and intellectual property rights/obligations to local sales Developing a risk inventory for compliance risk is similar
tax, licensing requirements, and environmental standards. to the process of developing the ERM risk inventory. As
Further, these threats constantly change with new and illustrated in figure 4.1, there are a number of
altered legal and regulatory requirements; with shifts in approaches that can be taken, with some approaches
organizational strategies, such as a retailer entering the being more effective in identifying new and emerging
business of health care services; and with the emergence of risks.
new compliance risks as societal values evolve. To function
effectively, the C&E program needs to have processes in For compliance risk identification, some approaches have
place to identify and track these various risks across the been found to be particularly useful. Many organizations
organization. start with a risk inventory identified by similarly situated
organizations or industry associations. This inventory needs
Historically, many organizations approached compliance to be viewed as a starting place and should then be tailored
with laws and regulations in silos, developing programs to to the organization, considering its unique operations.
address specific issues where the organization or others Another often-used approach is to interview key employees
in the industry had encountered significant challenges. For to better understand operations and determine applicable
example, the business unit directly involved with the risk, laws and regulations that they deal with on a regular basis.
such as antitrust or environmental or money laundering, As noted in figure 4.1, this method is effective at identifying
existing laws and regulations posing compliance risks and
c o s o . or
g
Figure 4.1 Approaches for Identifying Risks*

Types Cognitive Data Interviews Key Process Workshops
of Risk computing Tracking Indicators Analysis
Existing
New
Emerging
Source: COSO Enterprise Risk Management—Integrating with Strategy and Performance, Volume 1, p. 69
may provide an indicator of emerging risk, but it may not be compliance and ethical risks. Concerns specifically related
as effective at identifying new risks or changing enforcement to third-party risks include the following:
standards not yet apparent to employees. Surveys may also
be used to ask key managers to identify applicable laws and 1.The organization usually has a lessened ability
regulations that they deal with regularly in their area.1 to control or oversee the work of a third party
than it would with its own employees.
Regardless of the approaches taken, the variety and
complexity of compliance risks create the need for 2.Third parties often do not have as strong of
operations managers and risk owners to be involved in an incentive to adhere to compliance and
the risk-identification process. One way of doing this is ethics expectations as employees do.
the
development of compliance committees at various levels in 3.Third parties may operate in geographic areas
the organization. Senior management and the board must that are distant from the organization’s
also be involved by including the C&E program leadership in headquarters, sometimes with differing laws,
strategic planning so they can understand the organization’s norms, and customs.
current and evolving strategies and the related compliance
risk. For these reasons, assessing risk involving third parties can
be complicated, but risk assessments should be performed at
Information provided by regulators can also be helpful in the time a third party is engaged and periodically thereafter.
identifying new and emerging risk, because many of these The extent of each risk assessment, due diligence process,
agencies issue alerts regarding where they see emerging and subsequent monitoring and auditing should consider the
risks and have compliance concerns. For example, the SEC role the third party plays, materiality, and other factors that
Office of Compliance Inspections and Examinations issues could affect the level of risk associated with each third party.
special risk alerts, and the HHS OIG publishes its work plan
to alert organizations to areas considered to be high risk. Not all compliance risks will rise to the entity level and
appear in the ERM risk register; however, the risk of
Further, compliance risk extends beyond the legal boundaries regulatory change would be included in such an entity-level
of the organization. Third-party contractors, suppliers, inventory in most organizations.
and partners in strategic alliances can pose significant
Table 4.1 Identifies risk

Key • Describe the compliance risk identification and assessment process in documented policies and procedures
characteristics • Identify compliance risks associated with planned strategy and business objectives
• Assess internal and external environments to identify risks
• Create process for identifying new and emerging risks
• Consider risks associated with use of third parties
• Consider information gathered through hotlines, other reporting channels, and results of investigations
.........
1 Judith W. Spain, Compliance Risk Assessments: An Introduction (Minneapolis: Society of Corporate Compliance and Ethics, 2020), 21–
25, https://compliancecosmos.org/compliance-risk-assessments-introduction.
c o s o . or
g
Principle 11 — Assesses severity of risk

prohibiting such payments or the controls around the
Severity of a compliance risk is usually assessed primarily
payments process. In theory, one would like the assessment
on the basis of likelihood and impact. Other factors may
to be made under the assumption of no controls at all being
also be considered and will be explained later.
in place, but it is difficult for people to imagine such “no
control” situations. They usually make the assessment
Likelihood is the probability that the risk could occur. In
assuming “normal controls” or some sort of “minimal
the case of compliance, this means the probability of
controls.” For greater precision, some assessment methods
specific noncompliance with a law/regulation or ethical
break the likelihood assessment in two parts: one for
misconduct. Assessing the likelihood of compliance risk in
likelihood or frequency and the other for effectiveness of
most cases is a subjective judgment. Despite being
internal controls, as shown in figure 4.2. Some models may
subjective, systematic judgment can be made. One
even consider preventive and detective controls as two
approach is to consider
separate factors, with preventive controls being more
the frequency of noncompliance. Will the event (e.g., a
relevant to likelihood or frequency, and detective controls
salesperson making an illegal payment to a government
more likely affecting the impact of an event based on the
official to gain a contract) occur once a year or once every
timeliness of detection.
five years? This judgment would be based on experience
or perhaps the organization’s historical data, if such data
In figure 4.2, the likelihood of occurrence is measured
is available. Another factor that enters into this
on a five-point scale from “rare” to “almost certain.”
assessment is the organizational context. Typically, the
Control
assessor makes assumptions about controls in place, such
assumptions and frequency are given descriptive anchors
as policies
that are then matched to the assessor’s beliefs.
Figure 4.2 Likelihood of Occurrence*

Scale Existing controls Frequency of noncompliance
5 • No controls in place Expected to occur in
Almost most circumstances
• No policies or procedures, no responsible person(s) identified, no training,
certain no management review More than once per year
4 • Policies and procedures in place but neither mandated nor updated regularly Will probably occur
Likely • Controls not tested or tested with unsatisfactory results At least once per
• Responsible person(s) identified year
• Some formal and informal (on-the-job) training
• No management reviews
3 • Policies mandated, but not updated regularly Might occur at some time
Possible • Controls tested only occasionally, with mixed results At least once in 5 years
• Responsible person(s) identified
• Training is provided when needed
• Occasional management reviews are performed, but not documented
2 • Policies mandated and updated regularly Could occur at some
Unlikely • Controls tested with mostly positive results time At least once in 10
• Regular training provided to the identified responsible person(s), but not documented years
• Regular management reviews are performed, but not documented
1 • Policies mandated and updated regularly May occur only in
Rare exceptional circumstances
• Controls regularly tested with positive results
• Regular mandatory training is provided to the identified responsible person(s), and Less than once in 10 years
the training is documented
• Regular management reviews are performed and documented
* Adapted from Judith W. Spain, Compliance Risk Assessments: An Introduction (Minneapolis: Society of Corporate Compliance and Ethics, 2020),
30, https://compliancecosmos.org/compliance-risk-assessments-introduction.
This approach is just one example. Every organization compliance committee or by the C&E program staff with
should customize its scale and measurement methodology input from management. Once the scale is determined, it
to fit should be applied consistently by the assessors.
its particular needs. This customization would be done by a
c o s o . or
g
The second component of risk severity is impact. Impact is • Operational — Potential disruption of business
the result or effect of risk in terms of the organization’s operations from plant shutdowns, suspensions,
strategy and business objectives. With compliance risk, one debarments, and loss of license
thinks immediately of civil and criminal fines and penalties,
and the possible direct financial consequences of • Reputation (image) — Effect of media coverage;
noncompliance. damage to organization’s image/brand; and subsequent
Another significant factor may be the reputational impact of diminished attractiveness to current and potential future
compliance and ethical issues. This and other consequences employees, business partners, vendors, and customers
(e.g., sanctions, suspension, and debarment) may have a
material indirect financial impact, as well as an impact on • Health and safety — Employee, patient, customer
morale and other factors that are difficult to measure.
• Ability to pursue strategic goals — Prohibition to
Impact of noncompliance and ethical failures can be assessed added new customers, loss of license
using a variety of measurement categories.
Figure 4.3 illustrates how these categories might be used to
• Legal — Consisting of civil and criminal fines and construct a scale for assessing the impact of compliance risks.
penalties
• Financial — Internal and external costs associated

with investigating and remediation (e.g., legal
fees, consultants, investigators)
Figure 4.3 Impact of Compliance Risks

Scale Legal* Financial# Operational Reputation (Image)+ Health and Ability to
(Potential Safety* Pursue
Disruption)* Strategic Goals*
1 In compliance < $1 million < 1/2 day No press exposure No injuries Little or no
Insignificant impact
2 Civil violation $1–$5 < 1 day Localized negative impact First aid Minor impact
Minor with little/no fines million on reputation (such as a treatment
single large customer) but
recoverable
3 Significant civil $5–$25 1 day–1 week Negative media Medical Major impact
Serious fines/penalties million coverage in a treatment
specific U.S. region or a
foreign country
4 Serious violation, $25–$100 1 week–1 Negative U.S. national or Death or Significant
Disastrous criminal prosecution million month international media extensive impact
probable coverage (not front injuries
page)
5 Significant violation, > $100 > 1 month Sustained U.S. national Multiple Loss of
Catastrophic criminal conviction million (and international) negative deaths or accreditation
probable, loss of media coverage (front several or license
accreditation or page of business section) permanent
licensure disabilities
# Amounts are examples only; each organization should set amounts to reflect its size and financial strength.
* Adapted from Judith W. Spain, Compliance Risk Assessments: An Introduction (Minneapolis: Society of Corporate Compliance and Ethics, 2020),
39, https://compliancecosmos.org/compliance-risk-assessments-introduction
+ Adapted from Deloitte, Compliance risk assessments: The third ingredient in a world-class ethics and compliance program, Deloitte Development LLC, 2015.
As with the likelihood scale, each organization would adapt another, based on a wide variety of factors. Rather than assessing
the impact scale and factors to its own environmental severity at the organizational
context. The organization’s risk appetite would also be
reflected in setting the values used in the anchor labels.
An additional factor that may enhance the evaluation of

severity is the localization or regionalization of the
assessment. For multilocation and multinational
organizations, risk may vary from one location or region to
c o s o . or
g
level, determining separate measures can add an
additional level of precision to the assessment.
Assessment of each of the risks in the compliance

risk inventory can be made by compliance staff or
by a compliance committee and can be conducted
at different levels of the organization. In
conducting assessments, steps should be taken to
minimize bias by avoiding self-assessment and
using multiple assessors from varied disciplines
and experience to ensure that risks are
appropriately evaluated.
c o s o . or
g
Table 4.2 Assesses severity of risk

Key • Adopt a uniform scale/scoring system for measuring severity of compliance risks
characteristics • Consider qualitative and quantitative measures
• Establish criteria to assess impact and likelihood of compliance risk event occurrence
• Assess severity of risk at different levels (organizational, regional, affiliate, etc.)
• Consider design and operation of internal controls intended to prevent or detect compliance risk events
• Minimize bias and inadequate knowledge in assessing severity (e.g., minimize self-assessments, use
multidisciplinary teams)
Principle 12 — Prioritizes risks

for the most serious risks. How this is done will depend on
The assessments of compliance risks in terms of
the organization’s risk appetite and tolerances and its
likelihood and impact allow for prioritization across the
available resources. For instance, in the example, risks in the
organization. One method used to capture and
green areas would be periodically reassessed, but no specific
summarize the severity assessment is to construct a risk
risk response action or extensive monitoring action would be
inventory matrix.
taken. In the yellow areas, the risk owners would be required
to develop
Using the example scales from the preceding section, the
a risk mitigation plan to reduce or eliminate them without the
following matrix can be developed.
addition of significant resources. For those risks falling in the red
areas, compliance committees would be assigned to work with risk
Figure 4.4 Likelihood vs impact matrix owners to develop detailed response plans in which risk ownership
5 is clearly identified, assign responsibility for risk responses, and
Almost
Certain develop monitoring and auditing plans for the remediation efforts.
4
Likely In addition to severity and risk appetite, some organizations
LIKELIHOO
3 consider other factors in their risk prioritization. Adjustments

Possible
might be made to the risks on the basis of velocity,
2 persistence, and recovery. Velocity is the speed at which a
Unlikely
D
risk affects the organization, such as a serious food safety

1
Rare
violation that would require immediate closure of a food
processing
1
Insignificant
2 3 4 5 plant. Persistence is how long the risk affects the
Minor Serious Disastrous Catastrophic
organization, such as media coverage from criminal violations
IMPACT
lasting four or five years. Recovery refers to how long it
takes to fix the
This allows the organization to group risks in terms of how problem (i.e., time needed to manage the risk to tolerable
and when they will be addressed and the level of attention levels), such as how long it takes to implement improved
that each is given. Although it could be argued that the vendor due diligence criteria and processes to reduce the
organization ideally could address all of its compliance risks, risk of shell company transactions.
from a practical perspective, more direct and immediate
attention is required
Table 4.3 Prioritizes risks

Key • Prioritize compliance risks based on assessed level of risk relative to meeting of business objectives
characteristics • Use objective scoring based on assessment
• Consider use of other assessment criteria (trend, velocity, etc.) in prioritizing compliance risks
• Consider possible effects of planned changes in strategy and operations
• Develop risk-based action plans for mitigation (risk responses, implemented in next step)
Principle 13 — Implements risk responses implementation of improved internal controls over

Risk responses are designed to manage the assessed level compliance. Effective mitigation of a compliance risk
of risk and can take many forms. The most obvious involves consideration of all
response to an elevated level of risk is the design and
c o s o . or
g
seven elements of a C&E program for each risk (e.g.,
policies, training).
Many risk-specific policies involve internal controls. Internal

controls over compliance may be preventive or detective
in nature, and ideally a blend of both is in place. Although
c o s o . or
g
prevention of noncompliance and ethical misconduct is others may be much narrower. This is particularly pertinent
preferred, there may be practical considerations that result for the design of improved internal controls and certain
in an organization relying more heavily on timely detective auditing and monitoring procedures. The assessment of
controls for certain risks. risk and controls may reveal a vulnerability in one very
specific part of a lengthy process. For example, an
Effective improvement of internal controls requires an
assessment of the risk of product safety violations for a toy
understanding of the principal drivers of a particular risk.
manufacturer might reveal that new machinery installed on
If the likelihood or frequency of a risk drove the assessed
an assembly line has a particular vulnerability to improper
severity higher, improvements to preventive controls may be
operation that previous machinery did not have, leading to
particularly important. On the other hand, impact —
increased risk of the
especially when impact correlates to how long a risk goes
manufacture of unsafe products. The response in this
undetected — may be mitigated by improving detective
instance may be equally narrow: to implement a different and
controls.
more frequent inspection and maintenance schedule for the
newer machinery.
Risk responses may involve many actions other than
improvements to procedural internal controls. For example,
Of course, the benefits of adding or improving internal
targeted training aimed at areas of vulnerability may be
controls and other risk responses should always be weighed
useful. Training is a form of internal control that is a
against the financial and nonfinancial costs of these efforts.
particularly valuable response when the design of procedural
It may
controls is sound, but there are breakdowns in those controls be possible to reduce a compliance risk to an extremely
based on a lack of understanding of how the controls are to low level, but the cost of doing so in terms of slowing
be applied or a general lack of awareness of the controls. down
productivity may be excessive. Accordingly, cost is a
Training may also be more general in nature. If the
practical consideration when designing and implementing
observed behavior involves a weak culture of compliance,
risk responses. This potential for tension between
general training on the importance of compliance may be
compliance- related controls and operational efficiency is
useful.
often an important trade-off that requires attention.
Regardless of type, training, by itself, rarely results in
significant improvements. If coupled with improvements in For risk responses to be executed properly,
control processes, however, improvements are much more
accountability must be established. Responsibility for
likely to be observed.
responses is often shared among a variety of groups,
from the business
Another possible risk response is to increase or improve unit directly affected by the risk to other units within the
the auditing and monitoring function related to the organization, such as internal audit, human resources,
specific compliance risk assessed. This may be done information technology, compliance, and others. For this
through reason, the exact nature of the risk response should be
increased frequency or scope of monitoring and auditing. agreed upon by all parties that will play a role in the
Or it may be achieved by implementing new methods of execution. Once this is accomplished, a specific timeline for
auditing and monitoring. For example, increased use of the execution should be developed, with greater priority
data analytics aimed at detecting red flags of given to the risks identified as furthest above tolerable levels.
noncompliance or red flags of
breakdowns in internal controls (also discussed in
The final aspect of risk response involves following up to
connection with ERM Principle 18) can be powerful tools for
evaluate the implementation and operating effectiveness of
the audit and monitoring function.
those responses. An excellent response plan is only as good
as its execution. Part of the response plan should include
One aspect of risk response worth further consideration is
follow-up evaluations and ongoing monitoring to determine
the level of granularity of the response. Although some
whether all actions in the plan have been properly carried
control responses are very broad and apply to an entire
out and are operating as planned.
process,
Table 4.4 Implements risk responses

Key • Consider potential need for modifications in each element of the C&E program when designing risk responses
characteristics • Design compliance risk responses that consider the impact on other (non-compliance) risks and risk responses
• Assign accountability for each compliance risk response (including timeline, etc.)
• Follow up to determine whether compliance risk responses have been properly implemented as designed
• Consider compliance risk responses when developing monitoring and auditing plans
c o s o . or
g
c o s o . or
g
Principle 14 — Develops portfolio view

conflict with each other unless a portfolio view is taken
It is important to recognize the interrelationship among
in connection with both identifying and mitigating risk.
compliance risks, as well as the relationships between
compliance risks and other organizational risks. These
If risks are managed in isolation without consideration of
interactions can be an important consideration in both the
other risks, inefficiencies — and possibly conflicts — can
assessment of risk as well as the design and implementation
occur.
of risk responses. This consideration can also lead to the For this reason, viewing risks as part of an organization-
identification of certain drivers of risk — factors that do not
wide portfolio of risks is essential.
necessarily create a new risk, but that can increase the
likelihood of one risk event as a result of some other action Another consideration in developing a portfolio view is the
or event. extent to which compliance risks increase or decrease in
severity as they are progressively consolidated to higher
Here is a simple illustration: enhanced internal controls
levels within the organization. A compliance risk that at first
aimed at reducing the risk of a compliance violation
appears to be significant at a business unit level may be
could
rather minor by the time it is consolidated with other risks
increase the risk of delays in certain operational or
and rolled up to
production processes. This concern would be amplified if the
a higher level within the organization. Conversely,
production team had also identified a slowness in its
compliance risks that are minor in isolation may become
processes as a risk requiring a response. The two risk
much greater when consolidated with other seemingly minor
responses could potentially
risks.
Table 4.5 Develops portfolio view

Key • Consider risk interactions (i.e., how mitigating a compliance risk can affect other risks)
characteristics • Consider interactions of compliance risk responses with other risk responses
• Integrate compliance risk management with ERM
• Have regular meetings/communications between compliance and business units
c o s o . or c oso . or
g g
5. REVIEW AND REVISION

The legal, regulatory, and ethical environments of As Principle 6 discusses, the CCO should be involved in the
organizations are ones of constant change and, frequently, strategy-setting process to allow the C&E program to identify
increased complexity. Technological advancements have and manage the change in compliance risk resulting from
increased the speed of communications and activity, significant shifts in business strategy and objectives. For
expanding the number of individuals an organization can example, a technology company decides to start or acquire
affect across the globe. Even small organizations may be a new line of business in a highly regulated environment,
operating in multiple countries and jurisdictions, and such as providing cloud services for health systems’ medical
regulations in these places are proliferating. Stakeholder records, or an engineering firm seeks to begin contracting
expectations regarding organizational conduct continue to rise. with the federal government. An organizational shift to the
Thus, for compliance risk management to be effective, the use of third parties for business processes may also result in
organization must regularly review its compliance risk potentially significant changes to compliance risk.
management practices and capabilities and take steps to
continually improve its C&E program. Changes in the internal environment in people, processes,
and technologies can also result in changes to compliance
This section describes the application of the review and risk. For example, a change in senior personnel can result in
revision component of the COSO ERM framework and the a significant shift in the level of risk tolerance as well as the
following three principles associated with the management of compliance culture. Increased performance pressures (cost,
compliance risks: sales, productivity, efficiency, etc.) can affect risk. Mergers
and acquisitions can also drive change in compliance
15 Assesses substantial change risk. Changes to processes and technologies may also
16 Reviews risk and performance lead to potential changes to compliance risk. For example,
automation may result in the company being able to
17 Pursues improvement in enterprise risk management perform a task faster, but it may mean that the impact of a
failure will also be magnified.
Principle 15 — Assesses substantial change
Changes in the organization’s internal and external Changes in the external environment affect the organization’s
environment can have significant impacts on the compliance risks through changes to laws, regulations,
organization’s compliance risk profile, often very quickly, enforcement priorities, and societal norms and values.
which is why many compliance program standards require Assessing the impact on compliance risk has become
periodic re-evaluation and modification. The CCO needs increasingly complex due to the proliferation of laws and
to identify potential drivers of changing compliance risk. regulations across jurisdictions, often with conflicting
Broadly, these potential drivers include, but are not limited requirements. The C&E program needs to keep abreast of
to the following: changes to the regulatory environment through studying
information from industry and professional groups as well as
• Changes to the organization’s strategies and objectives
trends in enforcement and guidance provided by regulators.
• Changes to people, process, and technology There are also increasingly sophisticated regulatory change
management applications that can assist the C&E program
• Changes in regulatory requirements and/or with identifying and tracking.
societal expectations
c o s o . or
g
Table 5.1 Assesses substantial change

Key • Identify drivers of change in compliance risk — internal and external
characteristics • Consider how implementation of new strategic initiatives affects compliance risk
• Consider how changes in senior personnel affect compliance risk and/or risk tolerance
• Evaluate changes in laws and regulations
• Consider developments in enforcement, guidance from regulators, and other trends
• Assess changes in local/regional environments
Principle 16 — Reviews risk and performance

gaps. The plan should include a description of the planned
As noted in the discussion of Principle 1, the board of
risk responses, who is responsible for the response, how
directors has oversight responsibilities for the performance
response effectiveness is measured, and who will be
of the organization’s C&E program, and the CCO and
responsible for the performance review.
management are responsible for the program’s design and
implementation. For the board and management to carry
One model that can help establish role clarity is the
out their responsibilities, mechanisms are needed to provide
Three Lines Model, formerly the Three Lines of Defense,
assurance that compliance risks are being managed within
updated July 2020 by The Institute of Internal Auditors.
tolerable levels.
This framework distinguishes among the following three
groups (or lines) involved in effective risk management:
The goal of the reviews of C&E program performance goes
beyond just providing the needed assurance for the board
First line roles (management):
and management to fulfill their responsibilities for managing
• Leads and directs actions (including managing risks)
compliance risk to acceptable levels; the goal is also to
and application of resources to achieve the objectives
continually improve the C&E program. Regulators have
of the organization
become more explicit in their expectations regarding the
review of C&E program performance as a critical element of
• Maintains a continuous dialogue with the governing
an effective compliance program. As noted earlier, one of the
body, and reports on planned, actual, and expected
seven elements of an effective compliance program under
outcomes linked to the objectives of the organization,
the USSG includes the expectation “to evaluate periodically and risk
the effectiveness of the organization’s compliance and ethics
program.” Similar expectations for assessment of the C&E • Establishes and maintains appropriate structures
program’s performance are found in guidance from various and processes for the management of operations
regulators across the globe. and risk (including internal control)
The expectation is for two types of review: (1) a • Ensures compliance with legal, regulatory and
review of compliance risks that are considered to be a ethical expectations
high priority based on their assessed likelihood and
impact of noncompliance and (2) periodic review of the Second line roles (management):
overall performance and effectiveness of the C&E • Provides complementary expertise, support,
program. In monitoring, and challenge related to the management
addition to reviews by auditing and monitoring, there is an of risk, including the following:
expectation for the use of other mechanisms to provide
feedback regarding C&E program performance, particularly - The development, implementation, and continuous
a trusted system through which employees and others may improvement of risk management practices
report or seek guidance regarding potential misconduct. (including internal control) at a process, systems,
and entity level
For each high-priority compliance risk, in addition to
developing an education and training strategy, the - The achievement of risk management objectives,
organization should develop a monitoring and auditing such as compliance with laws, regulations, and
plan. Although the compliance function may take the lead acceptable ethical behavior; internal control;
in the development of such plans, it should not be the information and technology security; sustainability;
responsibility of compliance alone. Risk owners, internal and
audit, risk management, and potentially others should be quality assurance
involved in developing the plan. Role clarification for the plan
is essential to minimize duplication of effort and assurance • Provides analysis and reports on the adequacy
and effectiveness of risk management
c o s o . or
g
(including internal control)
c o s o . or
g
Third line roles (internal audit):

responsibilities to include,
• Maintains primary accountability to the governing
body and independence from the responsibilities
Delegates responsibility and provides resources
of management
to management to achieve the objectives of the
organization while ensuring legal, regulatory, and
• Communicates independent and objective assurance
ethical expectations are met.
and advice to management and the governing body on
the adequacy and effectiveness of governance and risk
Put more simply, the board is responsible for oversight of
management (including internal control) to support the
the compliance and ethics functions. The most senior level
achievement of organizational objectives and to
of management, where the CCO sits, is responsible for
promote and facilitate continuous improvement
establishing structures and processes aimed at ensuring
compliance. The next level of management is responsible
• Reports impairments to independence and
for providing expertise, support and monitoring to achieve
objectivity to the governing body and implements
compliance and ethics expectations.
safeguards as required
Figure 5.1 shows how this model can be used to design an
Above these three lines is the organization’s governing
auditing and monitoring plan for a high-risk area (conflict
body. The Three Lines Model describes the governing body’s
of interest in an academic medical center).
Figure 5.1 Auditing and monitoring plan for a high-risk area

1st Line 2nd Line 3rd Line
Risk Area Management Management Internal Audit
As Identified Structures Monitoring Independent
During Risk and policies and support auditing
Assessment
Conflict of Interest • Establish COI policies and procedures • Annual COI disclosure • Audit 10% of outside
(COI) travel payments against
• Educate personnel about COI policies • Purchasing and Accounts Payable travel
Pharmacy vendor reimbursements
• Report non-compliance to COI Manager registrations
• Report unauthorized • Level 2 review of
• Open Payments COI disclosures
vendors representatives and database
displays • Audit 10% of “nothing
• Research conflict to disclose”
• Advise personnel to database cross-check
contact Compliance with • “For cause” investigations
questions
• Review annual COI disclosures
In addition to the auditing and monitoring of high risks, DOJ to federal prosecutors for their use in assessing C&E
a review of the C&E program as a whole is necessary to program effectiveness.2 This guidance asks the following
provide the needed assurance for the board and executive
three fundamental questions regarding the organization’s
management, and it is also part of Principle 17 and the
C&E program:
effort to continually improve the C&E program. This review
involves periodic assessment of the effectiveness of the
1.Is the organization’s C&E program well designed?
C&E program as a whole. There are a number of
approaches that could be taken. The review could be
2.Is the program being applied earnestly and in good
performed by members of the compliance and ethics
faith; in other words, is the program adequately
function in a self-review, by the organization’s internal audit
resourced and empowered to function effectively?
function, or by external service
providers. At a minimum, the review should look to see that
3.Does the C&E program work in practice?
the C&E program incorporates all of the elements of an
effective compliance program described in the Appendix 1 Determining the answers to these three questions requires
(or other applicable standard) and that they are operating further inquiry into each element of an effective program,
effectively. as well as evaluating the C&E program as a whole.
An additional resource that could be used is the
Evaluation of Corporate Compliance Programs
guidance provided by
c o s o . or
g
.........
2 U.S. Dep’t of Justice, Criminal Div., Evaluation of Corporate Compliance Programs (updated June 2020), http://bit.ly/2Z2Dp8R.
c o s o . or
g
One issue of note in the DOJ framework is that the the data from the confidential reporting system (including
overall review of the C&E program is expected to include monitoring and auditing results and other data) should be
a measurement of the organization’s culture of used to identify gaps in the design or execution of the
compliance, including seeking input from all levels of C&E program. Research has consistently found, however,
employees that in many organizations, only a small portion of
to determine how they perceive senior and middle
misconduct
management’s commitment to compliance. issues are reported through the confidential mechanism, so
other feedback and data points must also be considered. For
Finally, in addition to monitoring and auditing, there are instance, many employees report misconduct to supervisors
other mechanisms that provide feedback on the rather than use the confidential mechanism. In the majority
performance of cases, these are handled by the supervisors and others
of the C&E program. A confidential reporting mechanism
in the organization; however, the data is not necessarily
through which employees and others can report suspected tracked or reported to compliance, so there is no feedback
misconduct involving the organization will identify specific
on C&E program performance. To get this feedback, some
instances where investigation and remediation are required
organizations have policies requiring supervisors to report
and may identify opportunities to improve the program.
such cases to compliance so they can be tracked and
Employees can also use this mechanism to seek guidance
analyzed.
and ask questions about their work and the work
environment. Other mechanisms are information from exit interviews —
where employees are asked if they have observed instances
When investigations of reported allegations of misconduct
of misconduct in the organization — periodic employee
conclude that there is indeed misconduct, the organization
surveys, and feedback from participants in compliance
should take appropriate steps to respond and to prevent
training.
further similar misconduct, including making appropriate
modifications to the C&E program. Analysis of trends in
Table 5.2 Reviews risk and performance

Key • Monitor performance against compliance and ethics metrics and report at the management and board levels
characteristics • Update compliance risk assessments on a periodic basis
• Develop monitoring plans for high-priority risks, assign assurance responsibilities clearly across the three lines,
and set clear performance expectations
• Ensure that internal audit considers compliance risk in connection with its review of entity risk and
performance
• Periodically assess the organization’s culture of compliance
• Ensure that annual C&E program work plans reflect risk assessment (cross-referenced)
• Include appropriate audit rights clauses in third-party contracts to facilitate monitoring and auditing
• Obtain feedback from participants in compliance training, hotline reports, employee surveys, and exit
interviews
• Require that implementation of corrective action plans is an important metric monitored by management and
the board
• Perform root cause analyses for compliance risk events experienced
Principle 17 — Pursues improvement in many regulators, proactive efforts by the organization

enterprise risk management may be
One of the key indicators of an effective C&E program is a
commitment to continuous improvement. Principles 15 and
16 explain the importance of using a variety of
mechanisms to identify substantial changes in the
organization and its environment and to identify gaps in
program effectiveness. Merely identifying issues is not
enough, however. Action must be taken to adjust and
improve the C&E program.
Increasingly, regulators emphasize the importance of the
organization demonstrating its efforts to review the program
and take action to ensure that it does not become stale. For
c o s o . or
g
rewarded with reduced fines and requirements in resolution
agreements and prosecution decisions.
The CCO should meet periodically with the board, as well as

with the organization’s internal compliance committee, if one
exists. Together, they should address the results of
performance reviews and the C&E program’s proposed action
plan to address identified gaps in C&E program performance,
as well as proactive improvements to the program. In addition,
the results of investigations where
misconduct was found should be analyzed to determine root
cause and what adjustments need to be made to the C&E
program and discussed with the respective committee.
c o s o . or
g
Where adjustments and improvements to the C&E program Another action that can contribute to the continuous
are warranted, appropriate action plans should be developed improvement of the C&E program is benchmarking against
with timelines and specific responsibilities assigned. the practices of other organizations. Often this is done within
Progress on the action plan should be tracked, and there
the same industry; however, this may be too narrow, as
should be appropriate follow-up.
there are significant differences in the maturity of
compliance programs within industries. There is much to be
Not all improvements to the C&E program are reactionary
learned from looking at other industries, particularly ones
in nature. An important aspect of continuous improvement
that, because
involves taking proactive measures. The organization should
of their regulatory environments, have been dealing with
stay current on new or improved tools, as well as innovative
heightened compliance risks for some time.
approaches, that may improve program performance and
effectiveness.
Table 5.3 Pursues improvement in enterprise risk management

Key • Maintain awareness of current trends in compliance risk management (through training, review of regulatory
characteristics guidance, etc.)
• Ensure that compliance periodically self-assesses the C&E program’s performance
• Obtain feedback from the board on the quality and usefulness of compliance risk information shared
• Consider obtaining periodic independent evaluation of the C&E program
• Consider benchmarking the C&E program against similar organizations
• Review efficacy of the compliance risk assessment process on a periodic basis
• Ensure that internal audit plays an active role in periodically evaluating the effectiveness of the C&E program
c oso . or
g
6. INFORMATION, COMMUNICATION, AND

REPORTING FOR COMPLIANCE RISKS
This section describes the application of the information, of transactions or activities for red flags. These tests
communication, and reporting component of the COSO ERM can target (1) breakdowns in internal controls designed
framework and the following three principles associated to prevent noncompliance, (2) instances or patterns of
with compliance risks: noncompliance, (3) breakdowns in internal controls designed
to detect noncompliance, or (4) other indicators or effects of
18 Leverages information and technology noncompliance. Data analytics look through digital records
19 Communicates risk information to identify anomalies that are consistent with any of these
four targets. Further, properly designed data analytics
20 Reports on risk, culture, and performance can be deployed in a manner that focuses on high-priority
compliance risk areas based on the risk assessment.
Principle 18 — Leverages information
and technology For example, digital markers can indicate whether certain
For a compliance function to effectively manage a C&E internal controls for compliance are functioning as designed
program, it must have timely access to information (e.g., is digital evidence consistent with expectations of
pertaining to each of the elements of the C&E program. For reviews and approvals performed by supervisors when this is
example, done electronically?). Digital evidence can also reveal other
to effectively carry out a monitoring and auditing function, anomalies that are consistent with noncompliance, such
the compliance function must have access to all information as indications of records being altered or substituted after
relevant to detecting noncompliance or breakdowns in a transaction has supposedly been completed. Analytics
compliance-related internal controls. can also be applied to unstructured data in pursuit of the
identification of compliance-related anomalies. Technology
Technology can be a vital asset in connection with several enables organizations to scan or actively monitor electronic
aspects of a C&E program. For example, technology can be communications (e.g., email, text messages, etc.) or
utilized to deliver compliance awareness training through other text (e.g., explanations on purchase orders, journal
a wide variety of methods and formats, with interactive entries, etc.) for signs of nefarious activities. For example,
features that improve learning in comparison with other communications between a manager and their subordinates
methods, such as live classroom-based training. Technology- could reveal signs of extreme pressure to meet deadlines,
assisted training is often easy to update in order to rapidly increasing the risk of employees overriding key compliance
address new issues or simply to keep training fresh. controls.
Nowhere is technology more useful to compliance than in Another use of information and technology involves
the monitoring and auditing component of the C&E performing initial assessments of information provided
program. Unlike with a sampling approach to auditing, through an organization’s confidential reporting mechanism.
properly designed data analytics can analyze 100% of a
population
Table 6.1 Leverages information and technology

Key • Ensure that compliance has access to all information relevant to effectively manage compliance risk
characteristics • Provide compliance with relevant information technology/data analytics skills or access to such skills
• Utilize data analytics in monitoring/auditing (monitor compliance and performance of internal controls)
• Create automated dashboards/reports for monitoring compliance
• Leverage technology to provide for the delivery of effective compliance and ethics training
• Utilize technology to facilitate risk assessment process (scoring, reporting, etc.)
c o s o . or
g
Hotline calls can be a valuable source of information developed and delivered by managers and supervisors — all
relating to allegations of specific acts of noncompliance or aimed at personalizing the roles that various employees
unethical workplace behavior. Prior to launching a full have in the C&E program. Throughout this process, the CCO
investigation and compliance team play an integral role, providing
or interviewing employees, data analytics can be utilized to
guidance and even assisting in preparing certain messages,
assess the credibility of the allegation or help focus the
including
scope of the investigation. those addressing lessons learned from compliance failures
the organization has experienced.
Information and technology can also be used to provide
managers with dashboards or other reports customized to Communications may take a variety of forms, from emails,
each business unit (discussed further in Principle 20). Timely posters, and other recurring means to town halls,
information about compliance-related activities and results of meetings, and other events. Informal communications
monitoring efforts enables managers to act quickly, from managers and supervisors are another effective
minimizing the impact of any identified problems. means of articulating employees’ roles and responsibilities
in connection with the C&E program. Collectively, these
Principle 19 — Communicates risk information
different methods of communication should reinforce and
Of all the characteristics that benefit a C&E program,
make reference to the more formal compliance and ethics
communication is the most vital. The compliance function
training explained in connection with Principle 5.
should interact with virtually every business unit and
function within the organization, acting as a partner in
One commonly overlooked area of compliance
identifying
communication pertains to an escalation policy or protocol.
and managing compliance and ethics risks that threaten
Certain allegations, issues, findings, or investigations should
the organization, delivering quality training and information
be disclosed beyond the team that is charged with looking
regarding compliance and ethics risks, and responding to
into the matter. For example, if an allegation of improper
allegations or concerns about compliance matters.
conduct is aimed at a lower-level employee in an
organization, the team responsible for investigating such
The partnership between compliance and individual business
matters likely does not need to inform many others within the
units is essential to the effectiveness of the C&E program.
organization; however, if the allegation was against a
Just as the business units know their operations better
member of the executive team, or it involved very serious
than anyone, nobody is better positioned to help the
matters, some level of disclosure of the matter to the board
business unit understand the ramifications of compliance
of directors is necessary.
and ethics issues than the CCO and the compliance team.
Accordingly, the management of compliance risks is most
The final step in communications involves the board
effective when there is a regular dialogue between
or its designated committee, as introduced in
compliance and each business unit, resulting in a shared
Principle 1.
mission of balancing
Much of this communication is done through the reporting
compliance with operational efficiency. This communication
described in Principle 20. An important aspect of
is a two-way street, not simply communication from
compliance risk management is the discussion of risk that
compliance to operations. Operations must be able to
should take place between the board and the CCO,
engage with compliance in a way that ensures that solutions
including the board challenging the CCO to ensure that all
are both effective and practical, and built with the real-world
internal and external compliance factors have been
insights that operations leaders bring to the table.
considered. Simply delivering a report, no matter how
thorough, is not sufficient and would
Effective compliance-related communication also has an
not demonstrate program effectiveness. It fails to
important cascading effect. Broad statements about ethics
demonstrate the level of oversight that regulators expect or
and compliance awareness should come from the most
that is essential to effectively manage compliance risk. In-
senior levels of management and the board of directors.
person explanation of issues addressed in the report,
From there, communications that are more tailored to
delivering meaningful information, and discussing actionable
individual departments, functions, and even specific jobs
plans for improving
should be
the program are all steps that are important to
effective management of compliance risk.
Table 6.2 Communicates risk information

Key • Ensure that employees receive clear and regular communications on their roles regarding C&E
characteristics • Require periodic reporting to the board by the CCO
• Establish protocols and ensure a clear understanding of an escalation policy
• Provide compliance risk communications that support and relate to training and job responsibilities
• Engage in effective two-way communication between operations management and compliance c o s o . or
g
c o s o . or g
Principle 20 — Reports on risk, culture,

the reporting gets to the department head/manager level,
and performance
information should focus on what is needed to manage
Closely related to the communication of risk information is
compliance risk in that area, although periodic reporting
reporting on risk, culture, and performance associated with
on organization-wide risk may provide helpful context.
compliance-related risks. These stakeholders include the
board of directors, any board-level committee delegated the
Reports on compliance risk management should address
responsibility of compliance risk oversight (if one exists), the
externally generated risks as well as those that result from
senior executive team, any internal compliance committee (if
the internal risk universe (e.g., employee acts). Third-party
one exists), and appropriate managers/heads of departments
or functions within the organization. Reporting to these risk management is an important element of a C&E
groups should be tailored to the unique needs and program.
Accordingly, reports should be prepared and distributed
responsibilities of each, as should the frequency of
reporting. to appropriate stakeholders on the status of third-party
suppliers, sales agents, and others who could create risk for
For example, reporting to the board should focus on the organization. These reports should focus on the results
what is needed for the effective oversight of the entire of third-party due diligence efforts in the selection or
C&E continued use of vendors and other third parties, site visits,
program — information about the risk assessment process, auditing and monitoring procedures, training provided to
identification of the most material risks and actions being third parties, and any other matter associated with
taken in response to those risks, meaningful compliance managing this area of risk.
metrics addressing both the structural and substantive
performance of the program, information about compliance- One final aspect of reporting that is critical to C&E program
related investigations, resource allocations and needs, etc. effectiveness is documentation. Typically, documentation
Reporting to the board should also periodically address involving investigations is maintained and reviewed only by
culture as it pertains to compliance and ethics. Culture can the compliance, legal, and/or investigations team. It is
be a difficult area to assess; however, efforts should be crucial to properly handle, preserve, and maintain these
made to provide the board with some perspective and materials and records in the event of legal action or
trends on government inquiry. Each compliance-related investigation
organizational culture associated with compliance and ethics. should be well documented, include a timeline of events
This may be accomplished through employee surveys; data and key steps/ actions taken along the way, and summarize
associated with culture; and other less formal methods, such any remedial steps. Whether a formal case management
as interviews and focus groups. software tool is used or something simpler is utilized,
maintaining this record is an important part of a C&E
As reports are designed for each level in the program. From these records, useful reports can be
organization chart, the information included should be generated that provide insight into the needs and
more granular and customized to the needs of each effectiveness of the investigations element of compliance
layer. By the time risk management.
Table 6.3 Reports on risk, culture, and performance

Key • Provide periodic reports on compliance and ethics risk assessments and related remediation efforts tailored to
characteristics key stakeholder needs
• Develop and report on meaningful operational and substantive metrics associated with the effectiveness of
the C&E program
• Provide managers with reports on completion and results of training of their direct reports
• Use a case management and reporting system for investigations and outcomes
• Establish and follow a policy that clearly articulates the nature of reporting on all significant remediation
efforts
c oso . or
g
APPENDIX 1.
Elements of an Effective Compliance and Ethics Program
Introduction
(4) (A) The organization shall take reasonable steps to
The seven elements of an effective compliance and ethics
communicate periodically and in a practical manner
program are described in the U.S. Federal Sentencing
its standards and procedures, and other aspects of
Guidelines (USSG), ¶8B2.1, subsection (b) as follows:
the compliance and ethics program, to the
individuals
(1) The organization shall establish standards and
referred to in subparagraph (B) by conducting effective
procedures to prevent and detect criminal conduct.
training programs and otherwise disseminating
information appropriate to such individuals’ respective
(2) (A) The organization’s governing authority shall be
roles and responsibilities.
knowledgeable about the content and operation of
(B) The individuals referred to in
the compliance and ethics program and shall
subparagraph (A) are the members of the
exercise reasonable oversight with respect to the
governing authority,
implementation and effectiveness of the compliance
high-level personnel, substantial authority personnel,
and ethics program.
the organization’s employees, and, as appropriate, the
(B) High-level personnel of the organization shall ensure
organization’s agents.
that the organization has an effective compliance
and ethics program, as described in this guideline. (5) The organization shall take reasonable steps—
Specific individual(s) within high-level personnel shall (A) to ensure that the organization’s compliance
be assigned overall responsibility for the compliance
and ethics program is followed, including monitoring
and ethics program.
and auditing to detect criminal conduct;
(C) Specific individual(s) within the organization shall
(B) to evaluate periodically the effectiveness
be delegated day-to-day operational responsibility
of the organization’s compliance and ethics
for the compliance and ethics program.
program; and
Individual(s) (C) to have and publicize a system, which may
with operational responsibility shall report periodically
include mechanisms that allow for anonymity or
to high-level personnel and, as appropriate, to the
confidentiality, whereby the organization’s employees
governing authority, or an appropriate subgroup of the
and agents
governing authority, on the effectiveness of the may report or seek guidance regarding potential or
compliance and ethics program. To carry out such
actual criminal conduct without fear of retaliation.
operational responsibility, such individual(s) shall be
given adequate resources, appropriate authority, and (6) The organization’s compliance and ethics program
direct access to the governing authority or an a shall be promoted and enforced consistently throughout
ppropriate subgroup of the governing authority. the organization through (A) appropriate incentives to
perform in accordance with the compliance and ethics
(3) The organization shall use reasonable efforts not to
program; and (B) appropriate disciplinary measures for
include within the substantial authority personnel of the
engaging in criminal conduct and for failing to take
organization any individual whom the organization knew,
reasonable steps to prevent or detect criminal conduct.
or should have known through the exercise of due
diligence, has engaged in illegal activities or other (7) After criminal conduct has been detected, the
conduct inconsistent with an effective compliance and
organization shall take reasonable steps to respond
ethics program.
appropriately to
the criminal conduct and to prevent further similar
criminal conduct, including making any necessary
modifications to the organization’s compliance and ethics
program.
c o s o . or
g
c o s o . or
g
¶8B2.1, subsection (c) follows by stating: monitoring; investigative responsibilities and procedures; and many
others.
In implementing subsection (b), the organization shall
periodically assess the risk of criminal conduct and shall Substantive policies focus on preventing and detecting
take appropriate steps to design, implement, or modify each
requirement set forth in subsection (b) to reduce the risk of
criminal conduct identified through this process.
This final provision requiring periodic compliance risk

assessments and continuous improvement of the C&E
program, which was added in 2004, is often referred to as
the eighth element of a C&E program.
All seven elements of a C&E program, along with periodic

risk assessments and ongoing program improvement, must
be in place and functioning well in order for the program to
be considered effective. It should be noted that the USSG,
which set forth the seven elements, are guidelines for
federal judges, but they may be much more than
“guidelines” for organizations. The word “shall” appears 17
times in
connection with the elements, and many believe the
guidelines represent the minimum standards for building an
effective C&E program, at least for U.S. organizations and
others operating in the U.S., as well as U.S.-based
multinational companies.
This appendix is devoted to an overview of each of these

elements, forming the basis for understanding the guidance
on its application to ERM found in earlier sections of this
publication.
Standards and procedures

Standards of conduct demonstrate an organization’s
commitment to an ethical workplace and a culture of
compliance with laws and regulations. This begins with a
code of business conduct and ethics. The code should be
designed to apply to all employees, management, and the
board. The code is supported by many policies and
procedures. A code should also apply to certain third parties,
such as vendors
and suppliers, although this code is often different and
more abbreviated than the code that applies to
employees.
Two types of policies and procedures are essential to a C&E

program: structural and substantive. Structural policies create
the framework for how the program operates. Substantive
policies address the organization’s positions on the key laws,
regulations, and standards that apply to its business
activities.
Examples of structural policies and procedures are those that

define the roles and responsibilities of the compliance officer,
compliance committee, and the board; methods for reporting
suspected wrongdoing; processes used for auditing and
c o s o . or
g
specific compliance violations (e.g., bribery, false its Evaluation of Corporate Compliance
claims, antitrust, environmental, record retention) Programs guidance.
by communicating the organization’s expectations
for employee behavior in connection with There may also be an internal compliance committee, with
individual risk areas. representatives from major functional areas and/or
operating divisions. Although the CCO may be the most
Governance, oversight, and authority visible leader of a C&E program, an internal compliance
The compliance and ethics function should be committee can be a very effective method of program
subject to effective oversight at the board, management, ensuring that
management, and compliance officer level.
The board has a clear responsibility to ensure that

an effective C&E program is in place and to
provide adequate oversight of the program by
being knowledgeable about the content and
operation of the program. The board must also
ensure that the CCO is positioned at a senior level
within the organization and has adequate
resources and authority to effectively manage the
program.
In some instances, compliance oversight at the

board level is delegated to a committee, such
an audit or compliance committee. In other
cases, compliance oversight is handled by the
board as a whole. Either way, the CCO should
have
a reporting relationship with the board or a
committee of the board, even if there is also
a reporting line to another executive
position, such as to the CEO.
In this respect, the compliance function is similar

to an internal audit function, where independence
and autonomy are important. From a day-to-day
operational standpoint, the top compliance
professional may report to another member of the
senior management team, but there should always
be a direct reporting line to the board as well so
that the compliance officer can have candid
discussions without interference from other
members of management.
Although the board provides oversight,

management is responsible for executing the
program — ensuring that employees complete
training, report concerns, fix problems, or perform
work activities consistent with program
requirements. The USSG recognized that it is
ultimately management that is responsible for the
ensuring the program is effective.
The CCO has day-to-day responsibility for

operating the C&E program and must have the
necessary resources and
access to information to operate the program.
Sufficiency of resources was added to the list of
factors the DOJ considers when evaluating
compliance programs in the June 2020 revision to
c o s o . or
g
each operating division approaches compliance similarly. An employees and the board of directors is a hallmark of
additional benefit of such a compliance committee is the a robust and effective program. General training
value created by collaboration and input across functional covers the code of
areas to support the overarching objectives of the C&E
program.
The final critical element of compliance oversight

involves making sure there is a clear and written
understanding of the roles and responsibilities of each of
these functions or
committees. This may be documented in the form of a
charter or policy.
Due diligence in delegation of authority

Organizations should perform background checks before
hiring new employees and additional periodic checks when
permitted or required by law. In addition, the organization
should consider the person’s past support of (or failure to
support or execute) the organization’s C&E program when
promoting employees to positions of greater authority. The
level and type of background check should correspond to
the position of each employee, based on the role that
person has, or will have, in relation to compliance risks.
The USSG refer to this expectation in connection with

“substantial authority personnel,” a term defined in the
application notes as “individuals who within the scope of
their authority exercise a substantial measure of discretion
in acting on behalf of an organization,” noting that these
individuals may or may not be considered management.
The clear inference is that the scope of diligence should
grow as the level of responsibility grows. Compliance may
wish to
work with human resources and other functions to make
these determinations.
Though not explicitly stated in the USSG, regulators have

grown to expect that organizations perform appropriate
levels of due diligence on third parties that create or involve
compliance risk for the organization. For example, if a
company utilizes a third party located in another country to
represent the organization, or to sell to customers in that
country, an appropriately scaled background check — based
on the assessed level of compliance risk involved — would
be expected.
Communication and training

Communication and training, when done effectively,
contribute to the prevention and detection of compliance
issues. Every employee and member of the board of directors
should receive training on general topics that are important
to the program, and more focused training on specific
compliance matters should be provided to personnel involved
in activities relevant to each compliance risk.
General training, done on at least an annual basis, for all
c o s o . or
g
conduct, maintaining a culture of compliance and ethics, how
to seek guidance and report suspected problems, the
organization’s nonretaliation policy, what the organization does
when suspected compliance issues are reported, and any other
relevant aspect of the program that affects everyone.
Focused training dives deeper into specific compliance risk

areas, critical internal controls, and other procedures associated
with specific risks. Consequently, only those employees who play
key roles involving those risk areas are typically required to
participate in this type of training. An example of focused
training is a program aimed at sales personnel of an
international company on compliance with the Foreign Corrupt
Practices Act. It is not necessary for every employee to
understand what constitutes a violation of the act, but it is
critical for individuals involved in
international sales (and relevant support and finance teams) to
have a sound understanding of this risk as well as the controls
and procedures the organization has implemented to prevent
misconduct.
To be effective, training must be more than simple delivery of

educational content. In its June 2020 guidance, DOJ emphasized
the importance of (1) allowing employees to ask questions
during training and (2) evaluating whether training affected
employee behavior.
Although much of the training that involves compliance topics is in

the form of either traditional classroom style presentations or
online, web-based programs, training may also involve other forms
of education and communication. For instance, an email message
or a company newsletter may be used to inform the workforce or
reinforce traditional training on new or changed compliance
requirements. Communications may also address lessons learned
from compliance failures the organization has experienced.
Organizations can sometimes be held accountable for

compliance failures of third parties. Accordingly, training
should be considered for each third party based on an
assessment of the associated type and level of compliance
risk.
Finally, other forms of general communications also help to

create and maintain a culture of compliance and ethics.
Examples include supportive messages from the CEO,
informative articles in company newsletters, and many others.
Monitoring, auditing, and reporting systems Monitoring,

in the broad sense, refers to the assessment of whether
processes are operating as intended in pursuit of the system’s
improvement. Sometimes the term “monitoring” is used more
narrowly to contrast with “auditing,” where
auditing refers to an assessment by individuals independent of the
system. Both auditing and monitoring draw on the same set
c o s o . or
g
of methods and techniques, with a goal of obtaining to their supervisors, organizations must recognize that there may be
assurance on the quality of the system’s performance over situations in which that is not desirable or practical. Accordingly,
time and contributing to its continuous improvement (see making employees aware of other
figure A.1).
Figure A.1 Auditing, monitoring and reporting
Auditing
Monitoring
Activities
(nonindependent
ndependen
(it)
)
Other
Performance
Feedback
Accordingly, auditing is performed by individuals independent

of the function being reviewed. Auditing may be performed
by an internal audit department, other third parties, or by
individuals within the compliance function if structured so as
to maintain their independence. Monitoring is often
performed by a quality assurance function or managers,
supervisors, and other employees within the function being
reviewed.
A monitoring and auditing plan is an important driver of

compliance program effectiveness, and it should be designed
and updated based on periodic risk assessments. Monitoring
and auditing activities should be aimed at both (1) detecting
noncompliance (or signs of noncompliance) and (2)
identifying breakdowns in internal controls over compliance,
such
as areas in which a preventive or detective control is not
functioning as designed. A wide variety of techniques may be
used in monitoring and auditing. Examples include
observation and site visits, surveys, questionnaires and
checklists, interviews, reviewing transactions and
documentation, data analytics, and reviewing digital
evidence. The audit function may also provide assurance to
the board regarding the overall effectiveness of a C&E
program.
Another important mechanism of an effective C&E program

involves maintaining a trusted system for seeking guidance
and reporting suspected wrongdoing by employees (and
others). Employees should have multiple avenues for
seeking guidance regarding compliance and ethics issues
and for reporting what they perceive as potential violations
of laws, regulations, or the organization’s policies and
procedures.
Although employees may be encouraged to report matters
c o s o . or
g
options for reporting is important. Other options departing employees should provide one final opportunity
may involve telephone- or email-based systems for the employee to report suspected wrongdoing and to
(internal or operated by independent third provide feedback in other areas related to the C&E program.
parties) or direct reporting to others within the
organization, such as human resources, Investigations may result from information obtained via
compliance, internal audit, an investigations unit, the reporting system, but may also stem from an
certain members of senior management, or even organization’s
the board or audit/compliance committee.
Characteristics of an effective reporting system

include user options that allow for the following:
1.Anonymous reporting — The reporter’s

identity is not known (where allowed by law
), often achieved through a hotline or similar
mechanism
2.Confidential reporting — The reporter’s
identity is known only to a select few, and
those few are expected to take reasonable
steps to maintain that confidentiality while
pursuing the matter
3.Open reporting — The reporter is willing
or desires to have their identity disclosed
without limitations
These and any other methods of reporting should

be developed with consideration for federal, state,
and local laws in the countries and regions in
which the reporting system operates.
For any reporting to be effective, it must be

trusted. Trust is driven by many factors, but the
most important two are (1) a belief that the
organization will take allegations and concerns
seriously and perform a proper assessment in
response and (2) that reporters can expect to be
free from retaliation after they have reported their
observations and concerns in good faith.
Finally, DOJ encourages publicizing reporting

systems to third parties, in addition to employees.
Vendors, suppliers, and other third parties are
often in a unique position to observe signs of
possible violations that might not immediately be
observable by employees.
All matters reported should be reviewed

and assessed in a timely manner. The
assessment of a report should
consider whether further investigation is
necessary based on the information provided
by the reporter, the nature and
seriousness of the possible violation, and any other
information known that is relevant to the report.
Even in the most trusted of systems, some

employees may not feel comfortable reporting
wrongdoing until they are leaving an
organization. As a result, exit interviews of
c o s o . or
g
auditing and monitoring activities or even outside parties warnings up to termination of employment.
(e.g., customers, competitors, suppliers). Regardless of what
event triggered the concern, an investigation should be Organizational justice is critical to the success of a C&E
prompt, thorough, and independent of the affected function
or person, and it should be performed in accordance with
written policies and procedures. Case files or other
documentation should
be maintained and protected to ensure the integrity of
each investigation. Investigations are described further in
the section on responding to wrongdoing.
It is important to note that the investigation and

resolution of allegations are not the only goals of these
reporting mechanisms. An equally important goal is the
feedback provided on the C&E program’s performance
so that the
program can be improved. This requires tracking and
analysis of the trends in issues being reported and the areas
where guidance is being sought so that appropriate steps
can be taken to increase the C&E program’s effectiveness.
Incentives and enforcement

Noncompliance can be entirely unintentional — often the
result of ineffective controls, ineffective training or new
employee orientation, misunderstanding of procedures,
a deteriorating culture, or simply carelessness. A natural
deterioration in processes and internal controls occurs over
time, unless the processes or internal controls are
consistently enforced. Noncompliance can also be intentional
— carried out by employees who know they are violating
organization policies and who may understand that they are
violating laws and regulations in the process.
The USSG require the use of incentives and similar tools to

promote consistent participation in and/or execution of the
C&E program. Just as boards and executives use financial
and recognition incentives to promote sales, safety
outcomes, customer or employee satisfaction, and other
strategic
goals, the USSG state that incentives should be a
component of an organization’s compliance efforts.
Incentives can be particularly effective in motivating
leaders to embrace and execute on the compliance
program but can also be used effectively at all levels in the
organization. Incentives can
be financial or nonfinancial in nature and can be
effectively integrated with an organization’s performance
management system.
In its explanation of enforcement, the USSG recommend

appropriate consequences for ignoring compliance
obligations or violations of law or policy. Such discipline
should consider whether acts of noncompliance, or the
failure to act, was intentional or unintentional, as well as the
severity of the noncompliance. The organization should
provide for a range
of potential disciplinary actions, from verbal and written
c o s o . or
g
program. Accordingly, enforcement and discipline must be
consistent across all levels of the organization, perhaps most
importantly at the highest levels. If the noncompliance of a highly
successful salesperson, an executive, or an influential employee
is tolerated while another employee is disciplined for the same
violation, the C&E program’s credibility will be undermined, and
the organization’s culture can be harmed.
As with all elements of a C&E program, discipline should always

consider the local/regional legal environment, as well as
contractual or labor union provisions.
In connection with incentives and enforcement involving

vendors, suppliers, and other third parties that may create
liability, the organization should ensure that there are
appropriately tailored contract provisions imposing relevant
compliance obligations and addressing the consequences of
noncompliance, including penalty provisions and contract
termination clauses.
Response to wrongdoing
No C&E program guarantees a lifetime of compliance for an
organization. If an organization is around long enough or is large
enough, noncompliance is inevitable regardless of how effective
the program is.
What an organization does in response to noncompliance is an

important factor that distinguishes effective programs from
ineffective programs. There are two key aspects of responding to
wrongdoing: investigating and remediating.
A compliance investigation must be prompt and thorough, fair to

all parties, and conducted by individuals who are independent
from the subjects and not otherwise conflicted. Other key
considerations in conducting a compliance investigation include
the following:
1.Notifications — Who should be informed about the

investigation (e.g., leaders, legal, outside parties)?
2.Expertise — Does the organization have all the expertise
needed to conduct the investigation, or should outside
assistance be brought in?
3.Involvement of compliance — Regardless of whether the
compliance officer is conducting the investigation, the
compliance officer should be informed and involved along the
way.
4.Documentation — Collect, protect, and preserve evidence
and other documentation gathered as part of an
investigation.
5.Oversight and management — The larger the investigation,
the more important it is to establish an appropriate chain of
command (including the involvement of legal counsel where
appropriate), for all parties involved to have their work
overseen and reviewed, and for the scope of the investigation
to be well managed.
c o s o . or
g
6.Scope — Understand what the scope of an

Risk assessment and program improvement
investigation is from the outset and gear the
Regulators consistently emphasize the importance of taking
investigation plan accordingly.
a risk-based approach to training, monitoring and auditing,
and the other elements of a C&E program. As such, a
There are many steps to an investigation (e.g., gathering
sound risk assessment process is critical. Approaches and
documents, identifying electronic records, conducting
considerations for assessing the risk of compliance and
interviews of personnel). And in the end, there may or
ethics events are generally very similar to assessing other
may not be any need or desire for a written report. But
types of risks. For example, a typical approach would include
the case file should always be closed out properly.
the following steps:
If the investigation uncovers compliance failures, a root 1.Identify compliance risks that are inherent to
cause analysis should be performed to fully understand
the organization’s activities
where any breakdowns or omissions in internal controls 2.Map compliance risks to existing internal controls
occurred, or whether weaknesses in the design of internal 3.Assess the effectiveness of internal controls
controls were identified. Once this is done, the organization 4.Assess the likelihood and impact of each compliance risk
must turn its attention to remediating the underlying 5.Prioritize (via scoring, heat maps, or other
problems. In cases in which existing policies and procedures methods) compliance risks based on the
were well designed, but the execution of those controls assessment
failed, remediation may require nothing more than training 6.Design risk responses (e.g., improvements to internal
(or retraining) certain groups of employees on those controls controls, training) to reduce risk to an acceptable level
and the reinstatement or introduction of the appropriate 7.Assign responsibility and monitor implementation of risk
monitoring processes. responses
In other cases, remediation involves significantly more effort. Although these are the core elements of a typical risk
Modifying policies and procedures, improving preventive assessment, many additional factors can be considered
controls, changing business processes or incentives, and to further enhance the quality of a risk assessment. Risk
any other remediation efforts should all be aimed at making assessments should be updated periodically, either on a
sure a particular act of noncompliance does not happen fixed time interval or when relevant new information comes
again. In cases where prevention is costly or impractical, to light indicating a change may have occurred that affects
remediation might involve adding or modifying detective a risk.
controls so that if noncompliance occurs in the future, it
will be detected and corrected sooner, resulting in reduced Another 2004 addition to the USSG involves an expectation
losses or penalties. Regardless of the nature of planned that efforts are made to continuously improve the C&E
actions, accountability for fully implementing remediation program.
plans should be established and monitored. Periodic risk assessment is one method of identifying
needed improvements to the program. But there are many
other ways of identifying improvements: a thorough root
cause analysis at the conclusion of an investigation,
feedback mechanisms, auditing and monitoring, and others.
Benchmarking against other organizations is also an
effective method of assessing program effectiveness.
Assessing program effectiveness can be performed internally
or by third parties (e.g., consulting firms). Additionally,
looking outside the organization — attending conferences,
reading publications, and monitoring government guidance
— is an excellent way to identify
emerging practices that can be adopted to improve a program.
c o s o . or
g
APPENDIX 2.
International Growth in Recognition of and Requirements
for Compliance and Ethics Programs
As described in section 1, global recognition of C&E 2. Standards of conduct, code of ethics, policies,
programs has grown considerably in recent years. In this and procedures applicable to all employees and
appendix, a few additional examples are provided. administrators, regardless of their position or function
3. Standards of conduct, code of ethics and policies
France extended, when necessary, to third parties, such as
Guidance on anticorruption compliance programs from the suppliers, service providers, intermediary agents, and
French Anticorruption Agency (AFA) in conjunction with associates
the 2016 French Sapin II Law was issued in 2017 and then 4. Periodic training on the program
updated in December 2019. The guidance notes that the 5. Periodic risk analysis to make necessary adaptations
compliance officer’s mission may go beyond anticorruption to to the program
include other laws, such as anti-money laundering, antitrust, 6. Accounting records that fully and accurately reflect
data privacy and others deemed appropriate for the scope the transactions of the entity
of the program. The following eight expected areas of 7. Internal controls that ensure the prompt elaboration
a program are described in the AFA’s guidance: and reliability of reports and financial statements of
the entity
1.Commitment by top management, including policies 8. Specific procedures to prevent fraud and illicit
and procedures, governance over the program that activities in the context of bidding processes, in
extends to the highest level of the organization, and the execution of administrative contracts or in any
communication about the program with employees and interaction with the public sector, even if intermediated
external partners by third parties, such as payment of taxes, subjection
2.A code of conduct to inspections, or obtaining authorizations, licenses,
3.An internal whistleblowing system permits, and certificates
4.Risk mapping, including risk assessment, prioritization 9. Independence, structure, and authority of the
and management internal body responsible for implementing the
5.Third-party due diligence program and monitoring compliance with it
6.Accounting controls 10. Channels of whistleblowing, open and
7.Risk training for managers and other employees exposed widely disseminated to employees and third
to risks parties, and mechanisms designed to protect
8.Internal monitoring and assessment whistleblowers
11. Disciplinary measures in case of
Brazil violation of the program
Brazil’s Clean Companies Act, which took effect in 2014, 12. Procedures that ensure the prompt
provides for penalties for the commission of certain acts, interruption of detected irregularities or infractions
including bribery, money-laundering, and fraud in public and the timely remediation of the damages
bidding for contracts, and other offenses. The law required generated
the government to issue a regulation on the act, which it did 13. Appropriate procedures for contracting and,
in the form of a 2015 decree (8.420/15). The decree states that as the case may be, supervision of third parties, such
a program will be evaluated for its existence and application, as suppliers, service providers, intermediary agents,
according to the following parameters: and associates
14. Verification, during mergers, acquisitions,
1. Commitment by the top management of the legal entity, and corporate restructuring processes, of the
including the councils, evidenced by the visible and commission of irregularities or illicit acts or of the
unequivocal support for the program existence of vulnerabilities in the entities involved
15. Continuous monitoring of the program
c o s o . or
g
aiming at improving it in preventing, detecting, and
combating the occurrence of acts prohibited under the
law
c o s o . or
g
16. Transparency of the entity regarding donations 1. A comprehensive risk assessment

to candidates and political parties 2. Vetting and training obligations for managers
3. Reporting procedures
The decree states that in evaluating the compliance program, 4. Recordkeeping
consideration will be given to the unique features of the 5. Due diligence
organization, including the number of employees, number 6. Other processes for minimizing the risk of abuses
of locations, countries in which it operates, it industry, its
complexity, and its use of third parties. Singapore
Singapore’s Corrupt Practices Investigation Bureau in
This provision is consistent with U.S. guidance stating that
2017 published “PACT – A Practical Anti-Corruption Guide
there is no “one size fits all” approach to C&E programs.
for Businesses in Singapore” to assist organization’s in
Every program should be tailored to fit the unique needs complying with The Prevention of Corruption Act. The guide
of the organization. describes the following four steps (thus the acronym, PACT)
that companies can take to prevent corruption:
Costa Rica
Costa Rica is another Latin American country (along with 1. Pledge — Tone from the top, anti-corruption
Argentina, Peru, and Chile in 2018) to recently enact a law policies, and a code of conduct
addressing compliance programs. The scope of the 2019 2. Assess — Conduct periodic risk assessments
Costa Rican law is domestic and international bribery and 3. Control and communicate — Internal controls,
corruption, as well as falsifying books and records to conceal audit checks, training and communication, and a
such corruption. Significant penalties can be reduced if a robust reporting system
company has a compliance program in place. Expectations 4. Track — Evaluate and improve the anti-
of the C&E program as described in the law include the corruption system
following:
Spain
1. Conduct a risk assessment for the business activity in Amendments to Spain’s Criminal Code that took effect on
Costa Rica July 1, 2015, provide for the regulation of corporate
2. Implement a code of conduct and adopt specific rules compliance programs. The amended code provides
and processes that prevent the commission of crimes companies with an exemption from criminal liability for
3. Establish specific policies and procedures to prevent
crimes committed by their officers or employees if the
crimes relating to public bidding contracts, obtaining
company has adopted a compliance program that includes
licenses, or any other activity related to the public
the following six elements:
administration
4. Determine the scope of these policies for third parties 1. Risk assessment
5. Establish adequate financial controls and financial 2. Standards and controls to mitigate any criminal risks
records aimed at the prevention of wrongdoing detected
6. Periodic anti-corruption training, including training for 3. Financial controls to prevent the crimes
third parties 4. Obligation to report to the compliance body
7. Perform periodic risk assessments and modify the
any violations of the standards and controls (a
program accordingly whistleblowing channel)
8. Establish a disciplinary model for noncompliance 5. Disciplinary system to sanction violations of the
9. Appoint a compliance officer and provide adequate compliance program by officers and employees
capacity and resources for the program 6. Periodic review of the compliance program, making
10. Conduct an external accounting audit the necessary adjustments when serious violations
occur or when the company undergoes organizational,
New Zealand structural, or economic changes.
The Anti-Money Laundering and Countering Financing
of Terrorism Act took effect in July 2013. One of the Summary
requirements of the act is the appointment of a compliance The summary in this appendix is far from complete and
officer and development of a reporting and compliance is provided only to illustrate some of the similarities and
program. differences among a handful of the many nations that have
promulgated some form of requirement or guidance relating
The key elements of a compliance program must include the to compliance and ethics programs. Organizations should
following: always consult the laws and regulations of each jurisdiction
in which they operate for further guidance.
c o s o . or
g
ACKNOWLEDGMENTS
Society of Corporate Compliance and Ethics & Health Care Compliance Association (SCCE & HCCA)
corporatecompliance.org
This publication is the product of the SCCE & HCCA Working Group on the Application of ERM to Compliance Risk:
Co-chairs
Urton Anderson, Director and EY Professor, Von Allmen School of Accountancy, University of
Kentucky Gerry Zack, CEO, SCCE & HCCA
Contributing editors
Dan Roach, Chief Compliance Officer, Optum360
Greg Triguba, Principal, Compliance Integrity Solutions, LLC
Contributors
Thanks to the following individuals for their input, feedback, and contributions:
Deborah L. Adleman, Ernst & Young LLP

Joseph Agins, Institutional Compliance Officer, Sam Houston State University
Jeffrey Driver, Faculty, Arizona State University & Principal, Soteria Risk
Works Margaret Hambleton, President, Hambleton Compliance LLC
Samantha Kelen, Chief Ethics and Compliance Officer, Cardinal Innovations Healthcare
Gwendolyn Lee Hassan, Managing Counsel – Global Compliance & Ethics, CNH
Industrial Walter Johnson, Assistant Privacy Officer, Regulatory Compliance, Inova
Health System
Caroline McMichen, Principal, McMichen Consulting and former Vice President, Global Ethics and Compliance, Molson Coors
(Retired)
Robert Michalski, Chief Compliance Officer, Baylor Scott & White Health
Rebecca Walker, Kaplan & Walker LLP
ABOUT THE SOCIETY OF CORPORATE COMPLIANCE AND

ETHICS & HEALTH CARE COMPLIANCE ASSOCIATION
The Society of Corporate Compliance and Ethics & Health Care Compliance Association (SCCE & HCCA) was founded in 1996
to serve the health care compliance profession and expanded in 2004 to serve the global compliance and ethics community
across all industries. With 20,000 members in 100 countries, SCCE & HCCA is the largest association furthering the interests
of the profession. Headquartered in Minneapolis, Minn., SCCE & HCCA exists to champion ethical practice and compliance
standards and to provide the necessary training, publications, certifications, and other resources for ethics and compliance
professionals.
c o s o . or
g
ABOUT COSO
Originally formed in 1985, COSO is a joint initiative of five private sector organizations and is dedicated to providing thought
leadership through the development of frameworks and guidance on enterprise risk management (ERM), internal control,
and fraud deterrence. COSO’s supporting organizations are the American Accounting Association (AAA), the American
Institute of Certified Public Accountants (AICPA), Financial Executives International (FEI), the Institute of Management
Accountants (IMA), and The Institute of Internal Auditors (IIA).
This publication contains general information only and none of COSO, any of its constituent organizations or any of the
authors of this publication is, by means of this publication, rendering accounting, business, financial, investment, legal, tax or
other professional advice or services. Information contained herein is not a substitute for such professional advice or services,
nor should it be used as a basis for any decision or action that may affect your business. Views, opinions or interpretations
expressed herein may differ from those of relevant regulators, self-regulatory organizations or other authorities and may reflect
laws, regulations or practices that are subject to change over time. Evaluation of the information contained herein is the sole
responsibility of the user. Before making any decision or taking any action that may affect your business with respect to the
matters described herein, you should consult with relevant qualified professional advisors. COSO, its constituent organizations
and the authors expressly disclaim any liability for any error, omission or inaccuracy contained herein or any loss sustained by
any person who relies on this publication.
c o s o . or
g
Ent e rprise Risk M a na g e m e nt
Committee of Sponsoring
Organizations of the
Treadway Commission
c o s o . or g
En t er p r i s e Risk M a n a g e m e n t
COMPLIANCE RISK
MANAGEMENT:
APPLYING THE COSO ERM
FRAMEWORK
Committee of Sponsoring Organizations of the Treadway Commission
c o s o . or g

Compliance Risk Management Applying The COSO ERM Framework

Uploaded by

Copyright:

Available Formats

Compliance Risk Management Applying The COSO ERM Framework

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Compliance Risk Management Applying The COSO ERM Framework

Uploaded by

Copyright:

Available Formats

C o m m i t t e e o f S p o n s o r i n g O r g a n i z a t i o n s o f t h e T r e a d w a y C o m m i s s i o n

Ent er pr ise Risk Ma n a g e m e n t

COSO Board Members

American Accounting Association (AAA)

American Institute of CPAs (AICPA)

Financial Executives International (FEI)

The Institute of Management Accountants

Ent erprise Risk M a n a g e m e n t

Committee of Sponsoring Organizations of the Treadway Commission

Copyright © 2020, Committee of Sponsoring Organizations of the Treadway Commission (COSO).

Design and production: Sergio Analco.

2. Governance and Culture for Compliance Risks 7

3. Strategy and Objective-Setting for Compliance Risks 11

4. Performance for Compliance Risks 15

5. Review and Revision for Compliance Risks 22

6. Information, Communication, and Reporting

About SCCE & HCCA 39

This publication aims to provide guidance on the application

What are compliance and compliance-related

Although the underlying acts (or failures to act) are carried

Most compliance violations either inherently cause harm or

Although most compliance risks relate to specific laws or

Accordingly, throughout this publication, the term

As this discussion illustrates, the scope of what an organization

International guidance on compliance and

A sampling of some of the guidance from outside the U.S.

5 Communication (including training)

6 Monitoring and review

Guidance has also been issued by the International

Leadership and commitment to the anti-bribery 2

Establishment of an anti-bribery compliance function 3

Sufficient resources provided for the anti-bribery management 4

Awareness and training on anti-bribery policies 6

Due diligence in connection with third-party business associates 7

Establishment and implementation of anti-bribery controls 8

Internal audit of the anti-bribery management system 9

Periodic reviews of the anti-bribery management system by 10

the governing body

Beyond bribery, ISO has also issued guidance more broadly on

Compliance obligations (identification of new and changed 1

Compliance risk assessment 2

Training and communication 4

A variety of other legal and regulatory developments that do

Additional examples of international guidance on C&E programs

differences, even if the scope of application of a C&E

The relationship between compliance,

A process, effected by an entity’s board of directors,

Figure 1.2 Risk Management Components

MISSION, VISION STRATEGY BUSINESS IMPLEMENTATION ENHANCED

Governance Strategy & Performance Review Information,

About this Guidance

Figure 1.3 Risk Management Components - The 20 principles

Source: COSO Enterprise Risk Management—Integrating with Strategy and Performance

Figure 1.4 Frequently used terms and abbreviations

2. GOVERNANCE AND CULTURE

Table 2.1 Exercises board risk oversight

Principle 2 — Establishes operating structures

Table 2.2 Establishes operating structures

Principle 3 — Defines desired culture